Step 1: Confirm you are a covered entity

Organizations that must comply with HIPAA are called “covered entities”.

The Privacy Rule protects most individually identifiable health information held or transmitted by a covered entity and its business associates, in any form or media, whether electronic, paper, or oral. The HIPAA Privacy Rule calls this information “protected health information” or PHI. Individually identifiable health information includes anything relating to:

• An individual’s past, present, or future physical or mental health or condition

• A provision of health care to an individual

• Past, present, or future payment for healthcare services

In essense, PHI identifies a person, or gives reason to believe a particular health record pertains to a specific person.  A medical record, laboratory report, or hospital bill would be PHI if it contained a patient’s name or other identifying information.

Covered entities include:

1. Health providers who conduct certain standard administrative and financial transactions in electronic form, including doctors, clinics, hospitals, nursing homes, and pharmacies. Any healthcare provider who bills electronically is a covered entity.

2. Health plans including:

   • Company health plans

   • Health insurance companies

   • Health Maintenance Organizations

3. Business Associates – individuals or entities, other than your staff, who perform functions or activities on your behalf, enabling them to access to PHI.  Such organizations include:

   • Accreditation organizations

   • Billing and claims processing companies

   • Consultants

   • Data analysis firms

   • Financial services companies

   • Legal services firms

   • Management administration companies

   • Utilization review

Examples of organizations generally exempt from HIPAA Rules include:

• Life insurers

• Employers

• Workers compensation carriers

• Most schools and school districts

• Many state agencies like child protective service agencies

• Most law enforcement agencies

• Many municipal offices

Tools and Resources for Step 1

If you are unsure if you are a covered entity, submit an inquiry to [email protected].