HIPAA covered entities: who counts, how a business associate differs, and who enforces HIPAA

The definition is in 45 CFR 160.103, and it names three groups. If you're in one of them, every part of HIPAA applies to you directly: the Privacy Rule, the Security Rule and the Breach Notification Rule.

1. Health plans. Anyone that provides or pays the cost of medical care.
2. Health care clearinghouses. Companies that convert health information between nonstandard and standard formats for someone else.
3. Health care providers that transmit health information electronically in connection with a transaction HHS has a standard for: claims, eligibility checks, claim status, referral authorizations, remittance and the rest.

The third group is the one most practices belong to, and the condition matters. A provider becomes a covered entity by sending one of those transactions electronically, directly or through a billing service that does it for them. Once you're covered, you're covered for all of your patients, not only the ones whose claims went out electronically.

Some organizations that hold health information are not covered entities: employers keeping employment records, life insurers, workers' compensation carriers, most schools, law enforcement, and consumer health apps with no provider or plan behind them. Other laws, such as FERPA or the FTC's rules, reach some of them instead.

1. Do you provide or pay for health care? If neither, you're not a covered entity, though you may still be a business associate.
2. Do you, or a billing service for you, send claims, eligibility checks or other standard transactions electronically? If yes, you're a covered provider.
3. Are you a plan? Insurers, HMOs, government programs and employer group health plans are covered. A small employer plan with fewer than 50 participants that the employer administers itself is excluded from the definition.
4. Do you convert claims data between formats for others? That's a clearinghouse.

CMS publishes decision charts that walk through the same questions for providers, plans and clearinghouses; the link is in the sources below. For a vendor relationship rather than your own status, the Do I need a BAA? checker answers the business associate side in four questions.

A cash-only practice that never bills insurance electronically may not be a covered entity. The moment one claim goes out electronically, it is, for every patient.Your engineer

A single legal entity can do covered and non-covered work: a university with a student health clinic, a manufacturer with an on-site clinic that bills insurers, a county that runs a hospital. HIPAA lets it become a hybrid entity by designating its health care components in writing. The rules then apply to those components, and the entity has to keep PHI from flowing to the rest of the organization as if it were a separate company. Without the designation, the whole entity is treated as covered.

A covered entity is defined by what it is. A business associate is defined by what it does: it creates, receives, maintains or transmits PHI on behalf of a covered entity or of another business associate. Software companies, billing services, IT providers, cloud hosts, transcription services, consultants and shredding companies are the usual examples.

One company can be both: a hospital is a covered entity, and it is also a business associate when it does billing for an affiliated practice. The vendor's side is covered in full in HIPAA for business associates.

• The HHS Office for Civil Rights (OCR) enforces the Privacy, Security and Breach Notification Rules. It investigates complaints and breach reports, opens compliance reviews, and settles most cases with a resolution agreement and a corrective action plan.
• CMS enforces the administrative simplification rules: the transaction and code set standards, unique identifiers and operating rules.
• The Department of Justice takes criminal cases, such as knowingly obtaining or disclosing PHI without authorization.
• State attorneys general can bring their own HIPAA actions on behalf of state residents, and many enforce state privacy and breach laws on top.

For a small practice the realistic path is OCR: a breach report or a patient complaint, a data request that starts with the risk analysis, and a settlement. The most common HIPAA violations are the ones those complaints describe. Recent settlements with small practices have ranged from $5,000 to $140,000. What that request looks like, step by step, is in what an OCR investigation looks like.

1. Know where PHI is. Every system, device and vendor. Our explainer on what PHI is lists the eighteen identifiers and the places patient data hides.
2. Run a risk analysis and keep it current. The free HIPAA risk assessment tool is a start.
3. Put the Security Rule safeguards in place: administrative, physical and technical, with a named security official. The Security Rule, clause by clause sets out each one.
4. Meet the Privacy Rule: a privacy official, a notice of privacy practices, patient access and amendment, and the minimum necessary standard.
5. Sign a BAA with every business associate before it gets PHI.
6. Train the workforce and keep a record per person.
7. Be ready for a breach: an incident plan and the 60-day notification clock.
8. Keep the documentation for six years.

Work through the full list in the HIPAA compliance checklist, and keep it current between reviews with HIPAA compliance software that tracks each item for you. Templates for a patient authorization form and a BAA review are on our free templates page.