If your clinic bills insurance electronically, it is almost certainly a covered entity under HIPAA, either directly or through a billing service that submits claims for you. The test below shows why and where to confirm it.
Definition
A covered entity is a health plan, health care clearinghouse, or health care provider that conducts certain standard transactions, such as claims, electronically, and so must follow HIPAA.
The three types are set out in federal regulation: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a HIPAA standard transaction. For a clinic, the practical question is: are we a provider, and do we send claims, eligibility checks or similar transactions electronically?
Most outpatient clinics and medical practices that bill insurance electronically meet this test. That generally holds even when a billing company or clearinghouse submits the claims on the practice's behalf.
Being a covered entity means HIPAA's Privacy Rule, Security Rule and Breach Notification Rule apply to the organization.
In practice at a clinic or small practice
Front desk staff and office managers run into the term in three common places:
- Patient paperwork: the Notice of Privacy Practices handed to new patients names the covered entity.
- Training: annual HIPAA training explains the practice's obligations as a covered entity.
- Vendor setup: a vendor asks "are you the covered entity?" before it signs a business associate agreement.
The practice is the covered entity, not each employee. Receptionists, medical assistants, billers and managers are part of the practice's workforce, and they follow its HIPAA policies.
The covered entity is also the party that signs a business associate agreement (BAA) with each vendor that handles PHI for it. Typical examples include:
- billing companies
- managed IT providers
- cloud storage services
- staff messaging tools
Check the scope of each agreement. A vendor's BAA may apply only to certain plans, and it may not extend to third-party integrations connected to the vendor's product.
In a multi-location group, the covered entity is usually the legal entity that owns the sites, or an affiliated arrangement of related legal entities. Individual locations are not usually treated as separate covered entities. If you are unsure how your group is set up, ask your privacy officer.
Not to be confused with
Business associate. A business associate is a person or company that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, such as a billing service or a software vendor under a BAA. The covered entity is the healthcare organization. The business associate works for it.
Hybrid entity. A hybrid entity is a single organization whose business includes both covered and non-covered functions. It designates which of its parts are health care components subject to HIPAA.
Providers without electronic transactions. A provider that never conducts standard transactions electronically, such as a cash-only practice with no electronic claims or eligibility checks, may not be a covered entity. Confirm this rather than assume it. A single electronic transaction, including one a vendor sends for you, can change the answer.
| Covered entity | Business associate | |
|---|---|---|
| Who | Health plan, clearinghouse, or provider conducting standard transactions electronically | Vendor or person handling PHI for a covered entity |
| Clinic example | The practice or practice group | Billing company, IT provider, software vendor |
| Signs a BAA as | The organization engaging the vendor | The vendor providing the service |
What the rules say
- Definition: the covered entity definition is in 45 CFR 160.103.
- Electronic-transaction trigger: this refers to the HIPAA standard transactions adopted in 45 CFR Part 162, including health care claims, eligibility inquiries and payment and remittance advice.
- Enforcement: the HHS Office for Civil Rights enforces the Privacy, Security and Breach Notification Rules for covered entities and business associates.
- Self-check: CMS publishes covered entity guidance that walks through the test step by step.
This is a plain-English summary, not legal advice. For a determination about your practice, consult your privacy officer or counsel.
Related reading
- Business associate: the other side of the relationship.
- Business associate agreement (BAA): what the covered entity signs with vendors.
- How a staff chat vendor handles HIPAA and BAAs
Back to the Healthcare operations glossary.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.