The Core Concept: Who Are Covered Entities Under HIPAA?
To understand what organizations HIPAA applies to, you must first understand the concept of a covered entity. The Department of Health and Human Services (HHS) defines three primary categories of covered entities that must follow HIPAA requirements.
1. Healthcare Providers
This is the most common category. If an organization or individual provides medical or health services and transmits any health information electronically in connection with a standard transaction (like billing insurance), they must comply with HIPAA.
- Which members of the healthcare team does HIPAA apply to?
- It applies to everyone, from doctors, nurses, and pharmacists to front-desk receptionists, billing specialists, and administrative staff.
- Examples include hospitals, clinics, dentists, chiropractors, nursing homes, and pharmacies.
2. Health Plans
Any organization that pays for the cost of medical care is a health plan and must follow HIPAA. This includes health insurance companies, HMOs, employer sponsored health plans (Self-funded, level-funded, and FSA), and government programs like Medicare and Medicaid.
3. Healthcare Clearinghouses
These are the middlemen organizations that process nonstandard health information received from another entity into a standard format (or vice versa), such as billing services that translate community health data into insurance claims.
The Extended Network: Business Associates
HIPAA doesn’t stop at covered entities. In the modern business world, healthcare organizations rely heavily on third-party vendors. If a covered entity hires an outside organization to help them carry out their healthcare activities and that vendor handles Protected Health Information (PHI), the vendor is classified as a Business Associate.
Under the HIPAA Omnibus Rule, Business Associates are directly liable for compliance. What kinds of persons and organizations are affected by HIPAA’s requirements under this category?
- IT providers and cloud storage companies
- Legal counsel and accounting firms
- Medical billing companies
- Shredding and data destruction vendors
If your organization fits into either the Covered Entity or Business Associate category, implementing a robust HIPAA compliance program is not optional; it is a federal requirement.
Who is Exempt From HIPAA?
A major source of confusion is determining who HIPAA does not apply to. Many organizations collect health-related data but are entirely exempt from HIPAA regulations because they do not meet the legal definition of a covered entity or business associate.
Who is exempt from HIPAA?
- Life Insurance Companies: While they require medical records to underwrite policies, they are not health plans under the law.
- Schools and Educational Institutions: Student health records are generally protected by the Family Educational Rights and Privacy Act (FERPA), not HIPAA. Though, as an employer, they might have a health plan that requires HIPAA compliance as well.
- Wearable Tech and Fitness Apps: If an individual tracks their steps or heart rate on a commercial smartwatch app, that data is usually not protected by HIPAA (though it may be subject to FTC consumer protection rules). There is an exception: if the individual receives this technology from a physician, the data could be covered by HIPAA.
- Law Enforcement Agencies and Court Systems: Medical records introduced in legal proceedings or held by police are generally not covered.
Does HIPAA Apply to Employers?
One of the most frequent questions we receive at Total HIPAA is: Does HIPAA apply to employers? In most circumstances, no. Standard employers are not bound by HIPAA rules when managing employment records.
If an individual requests a sick day and provides a doctor’s note, or if an employer requests a drug test as a condition of employment, that information is part of the employee’s personnel file. Personnel files are explicitly excluded from the definition of Protected Health Information (PHI). Therefore, an employer asking for proof of vaccination or a medical excuse is not violating HIPAA.
The Exception: If an employer sponsors a self-insured health plan for its workforce, the health plan itself is a covered entity. The employer must ensure a strict firewall exists between the employees administering the health plan and the rest of the company’s management to prevent health data from influencing employment decisions.
Summary: Who is Required to Follow HIPAA Requirements?
To recap, if you are trying to determine whether an entity must follow federal privacy guidelines, ask these two questions:
- Is the organization a healthcare provider, health plan, or healthcare clearinghouse that conducts electronic financial transactions?
- Is the organization a service provider (Business Associate) that creates, receives, maintains, or transmits health data on behalf of a covered entity?
If the answer to both is no, HIPAA does not apply.
Navigating the nuances of federal privacy regulations can be incredibly complex. Whether you are a newly established business trying to determine your compliance status or an established organization looking to train your workforce, we are here to help. Explore our HIPAA training solutions to ensure your organization stays fully compliant and secure. Still have questions? Schedule a clarity call to determine your compliance needs.
