What Is a HIPAA Covered Entity?

A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as claims or eligibility checks. Provider coverage depends on these transactions, including transactions conducted on the provider's behalf; business associate obligations can apply separately.

Three types. 45 CFR 160.103 lists three types of covered entities: health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a standard transaction.

Health plans. A group health plan with fewer than 50 participants that is administered solely by the employer that established it is excluded from the definition.

Health care clearinghouses process nonstandard health information into a standard format, or the reverse, for another entity.

Health care providers are covered only if they conduct a standard electronic transaction, such as submitting claims or checking eligibility, either directly or through a billing service. HHS provides a tool to help organizations determine covered entity status.

Health plan and clearinghouse status do not depend on the provider transaction test.

Dual roles. Business associate and covered entity are different roles, but the same organization can occupy both. A covered entity may be a business associate of another covered entity (45 CFR 160.103, definition of business associate, paragraph (2)). The overview of HIPAA laws describes the covered entity categories in general terms.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."