What is a HIPAA-covered entity?
A HIPAA-covered entity is an individual, organization, or agency to which the HIPAA Rules apply; covered entities include health care providers, health plans, and health care clearinghouses.
Health care providers include those providers who electronically submit HIPAA transactions like claims. Providers include but are not limited to:
- Doctors
- Clinics
- Psychologists
- Dentists
- Chiropractors
- Nursing homes
- Pharmacies
For HIPAA purposes, health plans include:
- Health insurance companies
- HMOs or health maintenance organizations
- Employer-sponsored health plans
- Government programs that pay for health care, like Medicare, Medicaid, and military and veterans’ health programs
Health care clearinghouses are public or private entities that process or facilitate the processing of nonstandard health information into standard data elements on behalf of other organizations.
HIPAA Rules apply to covered entities as well as business associates. If a covered entity engages a business associate to help carry out health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes what the business associate has been engaged to do, and requires the business associate to comply with HIPAA.
As the number and severity of third-party breaches continue to rise, companies are scrutinizing more closely not just on how they handle data, but how their vendors do as well. For security leaders, this means more security reviews are coming across their desks every day. Join us to learn how Vanta Trust Center can help streamline security reviews.