Am I a HIPAA Covered Entity?

Published: September 14, 2017•Last Updated: July 15, 2024•Read Time: 2 min

Summarize:

When it comes to HIPAA, covered entities must be compliant with the full extent of the regulation. HIPAA has set national standards for healthcare providers since it was first enacted in 1996.

But how do you determine who qualifies as a HIPAA covered entity in the first place?

Summary

Confirming whether your organization is a HIPAA covered entity is critical because that status triggers obligations under the Privacy Rule, Security Rule, and Breach Notification Rule, including posting a Notice of Privacy Practices, securing electronic PHI, and meeting breach reporting thresholds for fewer than 500 versus more than 500 affected. Use the provider, health plan, and clearinghouse definition to assess liability and reduce enforcement risk.

Below, we’ve created a quick and easy guide that you can use to assess if your organization qualifies as a HIPAA covered entity. Understanding your responsibilities as laid out by the federal HIPAA regulation is the most important thing you can do to start addressing your compliance and avoid your business some of the millions of dollars in HIPAA Violation & Breach Fines levied since the start of 2017 alone.

HIPAA Covered Entity Definition

HIPAA regulation defines a covered entity as healthcare providers, health plans, and healthcare clearinghouses involved in the transmission of protected health information (PHI). This transmission can take place for the purpose of payment, treatment, operations, billing, or insurance coverage. Covered entities can include organizations, institutions, or persons.

This HIPAA covered entity chart from the Department of Health and Human Services (HHS) provides a clearer breakdown:

via: HHS.gov

GET HIPAA COMPLIANT

HIPAA Compliance for Covered Entities

What regulatory requirements are covered entities responsible for under HIPAA?

HIPAA Privacy Rule: This addition to the regulation set standards for the use of PHI and patients’ rights to access their healthcare data. The standards for ‘Notice of Privacy Practices’ that all covered entities must post and provide to patients and clients was established in the Privacy Rule.
HIPAA Security Rule: This is another addition to the regulation that sets standards for the electronic transmission, storage, and use of PHI. The Security Rules also sets standards for computer and network access to PHI.
HIPAA Breach Notification Rule: The Breach Notification Rule sets specific standards for procedures and reporting that covered entities must complete in the event of a data breach. The rule identifies two classes of breaches: minor (fewer than 500 individuals affected), and meaningful (more than 500 individuals affected).

How to Address Your HIPAA Compliance

Compliancy Group gives healthcare professionals and covered entities confidence in their HIPAA compliance with The Guard™. The Guard is a web-based healthcare compliance tracking solution that helps simplify compliance.

Simplify Your Risk Assessment

See how The Guard makes it easy & secure.

Book a Demo

About the Author

Monica McCormack

Director of Content Strategy

Monica McCormack has 5 years of experience as a compliance copywriter and editor. She is well-versed in a diverse range of compliance topics including HIPAA, OSHA, and state privacy laws. She specializes in simplifying regulatory compliance, making it easy to understand for a general audience.

Monica has a background in marketing and is responsible for creating all forms of written content, including articles, resources, press releases, and case studies. She also works with Compliancy Group's association partners to deliver educational content for members.