Blog

First, we must define a HIPAA covered entity clearly. Basically, a covered entity is a health plan, a healthcare clearinghouse, or a healthcare provider. Specifically, this group must send health data in a digital way. The federal government states these three main types per 45 CFR 160.103. Therefore, you must know this rule for your business. You must obey the law to avoid big fines. Additionally, following these rules builds deep patient trust.

In short, covered entities keep patient details safe. Importantly, sending data online acts as the main trigger for these rules. Next, this post will explain the legal rules, the three main groups, normal tasks, and outside helpers.

Legal Definition Under 45 CFR 160.103

According to 45 CFR 160.103, a covered entity must send data in “electronic form in connection with transactions for which HHS has adopted standards.” Consequently, this strict rule applies to every group size. Furthermore, you must follow the Privacy Rule, Security Rule, and Breach Notification Rule after your very first digital task.

Three Types of HIPAA Covered Entities

Healthcare Providers

First, the law defines healthcare providers as pros who give medical care. Furthermore, the electronic transmission rule means they must send data online for billing.

Examples of healthcare providers include:

• Hospitals and hospital systems: Hospitals and big hospital systems give full medical care to sick people. Therefore, they send patient records and bills online all the time. Consequently, they must follow strict HIPAA compliance rules safely.
• Physician practices, clinics: Physician practices and local clinics give daily medical care to sick patients. Frequently, they send digital bills to health insurance companies. As a result, these active healthcare providers must keep patient privacy safe.
• Dentists, orthodontists, oral surgeons: Dentists, local orthodontists, and oral surgeons fix broken teeth and do mouth surgeries. Typically, they send digital insurance claims for their happy patients. Thus, they act as covered entities under HIPAA.
• Pharmacies (retail, mail-order): Retail and mail-order pharmacies give out important drugs to the sick public. Additionally, they check insurance plans online every single day. Therefore, they handle protected health information safely all the time.
• Psychologists, therapists, counselors: Psychologists, mental health therapists, and counselors treat sad or worried minds. Furthermore, they save private session notes and bill health plans online. Consequently, they firmly protect individually identifiable health information.
• Chiropractors, physical therapists: Chiropractors and helpful physical therapists help hurt people heal their broken bodies. Naturally, they check patient perks and send money requests online. As a result, they must use very strong data security.
• Nursing homes, home health agencies: Nursing homes and home health agencies give needed care to older folks. Moreover, they manage perks with Medicare and Medicaid online. Thus, they must guard frail patients and their private files.
• Laboratories, diagnostic imaging centers: Laboratories and diagnostic imaging centers test blood drops and take bone X-rays. Frequently, they share these digital notes with outside doctors. Therefore, they act fully as regulated healthcare entities right now.
• Telemedicine providers: Telemedicine providers give remote doctor visits over the fast internet.They send electronic health records and video streams constantly. Thus, they must use very safe tools to ensure patient privacy.
• Urgent care centers, ambulatory surgical centers: Urgent care centers and ambulatory surgical centers give fast medical help. Similarly, they use electronic health records to log quick patient visits. As a result, they follow very strict federal compliance steps.

Key clarification: However, cash-only providers who never send data online are NOT covered entities.

Health Plans

Second, health plans pay the big bills for medical care. Importantly, the plan itself acts as the covered entity, not the boss who buys it.

Examples of health plans include:

• Health insurance companies: Health insurance companies sell care plans to normal people and big firms. Furthermore, they clear millions of digital medical bills daily. Consequently, they must lock up huge piles of private data.
• Health Maintenance Organizations (HMOs): Health Maintenance Organizations guide group networks of local doctors and sick beds. Additionally, they plan patient care and pay provider bills online. Therefore, HMOs must follow all federal patient privacy laws.
• Preferred Provider Organizations (PPOs): Preferred Provider Organizations give flexible doctor networks for their sick members. Moreover, they manage online billing and care approvals all day. As a result, they act fully as strict health plans.
• Employer-sponsored group health plans: Employer-sponsored group health plans give medical care to hard company workers. Importantly, the real health plan acts as the regulated group. Thus, the boss must keep plan data completely separate.
• Self-funded employer health plans: Self-funded employer health plans pay worker medical bills from their own bank. Furthermore, they often hire third-party administrators for daily work. Consequently, these self-insured health plan options must ensure very strong safety.
• Medicare and Medicare Advantage: Medicare and private Medicare Advantage plans help millions of older citizens. Naturally, they clear endless digital bills and plan checks. Therefore, these big government setups need very high-level security steps.
• Medicaid and CHIP: State Medicaid programs and the Children’s Health Insurance Program help poor families. Additionally, they trade vital digital data with city hospitals. Thus, they tightly watch all electronic protected health information.
• TRICARE: TRICARE helps active military troops, brave veterans, and their sweet families. Moreover, this military health system clears global medical bills online. As a result, it keeps extremely tight digital safety locks.
• Veterans Health Administration programs: Veterans Health Administration programs give needed care for retired army troops. Furthermore, they keep huge electronic health records across the whole country. Consequently, they follow very strict federal privacy rules safely.
• Federal Employees Health Benefits Program: The Federal Employees Health Benefits Program helps government staff and their kids. Additionally, it plans massive digital payments with many insurers. Therefore, it strictly enforces all federal patient privacy laws.
• Long-term care insurance: Long-term care insurance policies pay for long nursing home stays and care. Naturally, they get digital care notes and money requests. Thus, they must protect this highly sensitive patient information.
• Medicare Supplement (Medigap) policies: Medicare Supplement policies pay for fees that normal Medicare leaves behind. Moreover, they electronically group these leftover payments with local doctors. As a result, Medigap plans act under strict privacy laws.

Exceptions: Meanwhile, a few clear exceptions exist. Workers’ compensation carriers, auto/casualty insurers, life insurance companies, and disability income insurance are not covered entities.

Healthcare Clearinghouses

Third, healthcare clearinghouses act as key data format helpers. They change messy data into clean forms.

Verified examples include:

• Medical billing clearinghouses: Medical billing clearinghouses take messy doctor data and format it perfectly. Furthermore, they send these clean electronic claims to insurance companies. Consequently, they act as vital data middlemen for everyone.
• Claims repricing companies: Claims repricing companies change medical bills based on strict network deals. Additionally, they send these new money numbers back to payers. Therefore, they handle highly sensitive electronic health information daily.
• Value-added networks (VANs): Value-added networks give highly secure online pipes for sharing medical data. Moreover, they ensure safe trips between big hospitals and insurers. As a result, these networks actively protect vital patient privacy.
• Community health information systems: Community health information systems grab local medical data for public health tracking. Naturally, they change many digital formats into one clean standard. Thus, they function safely as regulated clearinghouse entities today.
• EDI (Electronic Data Interchange) gateways: Electronic Data Interchange gateways change hard computer codes into readable medical forms. Furthermore, they let different hospital computer systems talk clearly. Consequently, they must follow very strict data security rules.
• Health information exchanges: Health information exchanges share patient records between different town doctors safely. Importantly, they perform crucial data format changes constantly. Therefore, they fall directly under strict federal privacy laws.

Functions: Finally, their main jobs include data cleaning and format changes. Additionally, they spot bad errors and check the basic facts. Thus, they move digital files between doctors and payers safely.

Standard HIPAA Transactions (Covered Transactions)

Next, per 45 CFR Part 162, the government defines covered standard transactions clearly:

• Healthcare claims and claim status: Healthcare providers send online claims to ask for money for medical care. Furthermore, they check the digital claim status to track cash. Consequently, these specific acts trigger strict federal compliance laws.
• Eligibility inquiries and responses: Doctor offices send online checks to see a patient’s exact insurance plan. Additionally, the health plan sends a digital reply back. Therefore, this fast online swap needs very strict data safety.
• Referral certification and authorization: Medical clinics ask for online referral notes before doing costly medical steps. Moreover, insurance plans send digital yes answers to clear these treatments. As a result, this process handles very sensitive data.
• Payment and remittance advice: Health insurance companies send online payments right to medical provider bank accounts. Naturally, they also attach digital notes to explain the money. Thus, they must hide this highly private financial health info.
• Premium payments: Bosses and regular people send online premium payments to keep insurance active. Furthermore, these digital cash transfers hold specific known health plan details. Consequently, the government watches these private financial data moves.
• Enrollment and disenrollment: Human resources teams send online sign-up data to add new hired workers. Similarly, they send drop notices when someone quits their hard job. Therefore, these digital updates involve highly watched personal data.
• Benefits coordination: Different health insurance companies match benefits online when sick patients have two plans. Additionally, they share digital files to split the big medical bills. As a result, they must protect fragile patient privacy.
• Electronic prescribing: Doctors use electronic prescribing tools to send drug orders directly to pharmacies. Moreover, this digital process stops dangerous messy handwriting errors safely. Thus, e-prescribing acts as a major standardized healthcare transaction.

Business Associates vs. Covered Entities

Furthermore, we must define a business associate under HIPAA. Basically, this outside firm does tasks for a covered entity. Importantly, they are not part of the covered entity’s main staff. However, the covered entity stays totally accountable for BA actions.

Common Business Associate Examples

• EHR/EMR software vendors: Electronic health records software vendors make the digital tools that doctors use. Furthermore, they hold and guard massive amounts of sick patient data. Consequently, they act as highly critical business associates today.
• Cloud storage and hosting providers: Cloud storage and secure hosting providers rent digital space to town hospitals. Additionally, they keep electronic protected health information safely online. Therefore, they must sign very strict federal compliance contracts.
• Medical billing companies: Outside medical billing companies do the hard money paperwork for busy doctors. Moreover, they read private patient sickness traits and treatment codes. As a result, they directly touch highly protected health information.
• IT support and managed service providers: IT support teams and managed service providers fix broken hospital computers fast. Naturally, they can sometimes see private electronic patient files. Thus, these smart tech experts must follow strict privacy laws.
• Legal and accounting firms (when accessing PHI): Special legal and accounting firms check hospital records during big court fights. Furthermore, they read patient files to check the real facts. Consequently, these smart pro firms become regulated business associates.
• Consultants and auditors: Outside consultants and fresh auditors check clinical workflows to boost hospital speed. Additionally, they read patient charts to check total medical quality. Therefore, they must hide all individually identifiable health information.
• Transcription services: Medical transcription services type out the voice notes that doctors record daily. Moreover, they listen to highly private patient medical past events. As a result, they touch fully protected data constantly.
• Shredding companies: Safe shredding companies destroy old paper medical records for busy local clinics. Naturally, they move heavy physical boxes filled with private patient traits. Thus, they act as highly important physical safety associates.
• Data analytics firms: Smart data analytics firms look at large groups of digital patient medical records. Furthermore, they help big hospitals guess local sickness trends accurately. Consequently, they safely touch massive amounts of strictly protected data.
• Claims processors: Third-party claims processors read complex medical bills for large self-funded boss plans. Additionally, they check treatment codes to clear big financial payments. Therefore, they manage highly sensitive medical and financial data.

Business Associate Agreement (BAA) Requirements

Next, the Office for Civil Rights (OCR) demands a formal Business Associate Agreement.

Required BAA elements include:

• Must be written contract executed BEFORE PHI access: You must sign a formal written deal with your outside vendor right away. Furthermore, you must finish this paper completely BEFORE they touch data. Consequently, this makes strict legal rules from day one.
• Defines permitted uses and disclosures: The clear legal deal states all allowed uses of the sensitive health data. Additionally, it lists exactly how the outside vendor can share details. Therefore, it stops bad unauthorized sharing of private patient records.
• Requires implementation of safeguards: The firm contract forces the vendor to use strong administrative, physical, and technical rules. Moreover, these thick walls block bad internet hackers safely. As a result, electronic patient files stay incredibly secure forever.
• Mandates breach reporting to covered entity: The strong deal strictly demands rapid breach reporting right back to the covered entity. Naturally, the vendor must tell the sick doctor if hackers steal data. Thus, the clinic can warn scared patients very quickly.
• Addresses subcontractor requirements: The long document legally sets all strict rules for any hired downstream subcontractors. Furthermore, the main vendor must force their smaller helpers to obey. Consequently, the entire data supply chain stays completely secure.
• Specifies data return/destruction at termination: Finally, the clear contract sets data return or total destruction at the end date. Additionally, the vendor must forever wipe all patient files safely. Therefore, no private medical records stay behind after you cancel.

Who Is NOT a HIPAA Covered Entity

Additionally, many groups do not fall under these strict federal rules.

• Employers: Bosses keep worker health records in their normal human resources job role. Furthermore, they manage sick leave doctor notes every single day. Consequently, regular bosses do not act as regulated covered entities.
• Life insurance companies: Life insurance companies ask for medical checks before they give big personal plans. Additionally, they grab deep health pasts from new eager buyers. Therefore, federal privacy laws specifically skip these life insurance sellers.
• Workers’ compensation carriers: Workers’ compensation carriers pay for medical care when tired staff get hurt working. Moreover, the government lets these specific insurance groups skip the rules entirely. As a result, they bypass the standard healthcare privacy laws.
• Property and casualty insurers: Property and casualty insurers pay for hurt bodies from fast sudden auto wrecks. Naturally, they read hospital bills to pay the big cash claims. Thus, the law entirely skips these specific casualty insurance firms.
• Schools and universities: Public schools and big universities hide student medical records under the strong FERPA law. Furthermore, FERPA beats HIPAA rules in these specific school grounds. Consequently, typical school nurses follow very different strict federal steps.
• Research organizations: Free research groups study new sick germs without giving normal medical care directly. Additionally, they only follow HIPAA if they officially join a sick clinic. Therefore, pure smart researchers stay fully legally exempt today.
• Providers who never transmit electronically: Some old doctors never send data online and only take plain green cash. Moreover, they still use basic paper charts for every single thing. As a result, the electronic rule completely skips them entirely.
• Consumer health/wellness apps: Many fun consumer health and wellness apps log your daily food and deep sleep. Naturally, they lack direct ties with official big hospitals or doctors. Thus, standard phone app makers stay outside federal privacy laws.
• Fitness trackers: Standalone fitness trackers count your daily steps and watch your fast heart rate. Furthermore, they do not link directly with official medical hospital computer systems. Consequently, they do not need strict federal HIPAA compliance.

Special case – Hybrid Entities:

• Organizations can designate healthcare components: Big groups can officially pick specific healthcare components inside their larger giant business shell. Additionally, they draw strict legal lines around these active medical rooms. Therefore, they safely isolate the deeply protected sick patient data.
• Only designated components subject to full HIPAA compliance: Consequently, only those specifically picked parts stay subject to full strict HIPAA compliance. Moreover, the rest of the massive giant business skips these heavy tasks. As a result, this smart trick saves huge piles of money.
• Example: For example, a big state university with a medical center can pick that medical center as its healthcare component. Furthermore, the main big school campus safely skips strict medical privacy rules.

Final Words And CTA For HIPAA Compliance Consultation

In conclusion, you must know your status to ensure total patient privacy. Furthermore, you must secure all electronic health records safely. Defend My Business does not provide these solutions directly. However, we have smart partners who offer these solutions. They can help you build a proper security management process and avoid big civil penalties.

Is my small practice a covered entity?

Yes, your small practice acts as a covered entity if you send digital claims. Size does not matter at all under strict federal law.

Does using a billing service make me a covered entity?

Absolutely. Using an outside medical billing service still makes you completely responsible for total compliance.

Are all insurance companies covered entities?

No, life and auto insurers do not act as covered entities.

Can an organization be both a covered entity and business associate?

Yes, a hospital can act as a business associate when giving IT help to another standalone clinic.

What’s the difference between PHI and ePHI?

Briefly, ePHI is just protected health information kept safely in a digital online form.

How long must I keep compliance documentation?

Generally, you must save all strict compliance notes very safely for exactly six long years.

What should I do if I discover a breach?

First, follow the strict breach notification rules right away. Next, tell the OCR and your hurt patients.

Are volunteers subject to HIPAA?

Yes, sweet volunteers act as part of your core team. Therefore, they need proper security training.