Covered entity
A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction — the organizations the HIPAA rules bind directly.
Updated
A covered entity is one of the three kinds of organization the HIPAA rules apply to directly: a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a HIPAA standard transaction — such as submitting a claim or checking eligibility electronically.
Nearly every practice that bills insurance electronically is a covered entity, and that status is what places its billing operation under the HIPAA Privacy Rule.
In practice
Defined at 45 CFR 160.103. A provider who never conducts a covered transaction electronically can fall outside the definition, but that is rare in a modern billing operation. A covered entity is responsible for its own compliance and for putting the required contracts in place with the business associates that handle protected health information on its behalf.
Commonly confused with
- Business associate: A covered entity is the plan, clearinghouse, or provider itself; a business associate is an outside party that handles PHI on the covered entity's behalf.