HIPAA covers HIPAA Covered Entities and their Business Associates, and it extends compliance obligations to workforce members, agents, and subcontractors that create, receive, maintain, or transmit protected health information on behalf of a regulated entity under a written agreement.
HIPAA Covered Entities
HIPAA Covered Entities include health plans, healthcare clearinghouses, and healthcare providers that transmit health information in electronic form in connection with a standard transaction. Healthcare providers become HIPAA Covered Entities when they conduct covered electronic transactions such as billing, eligibility inquiries, or claims status checks. Health plans include many insurers, employer-sponsored group health plans, and government programs that meet the HIPAA health plan definition.
Business Associates
Business Associates are persons or organizations that create, receive, maintain, or transmit protected health information on behalf of a HIPAA Covered Entity for services or functions regulated under HIPAA. Business Associate relationships arise from the role performed and the access to protected health information, not from the vendor’s industry label. A written Business Associate Agreement is used to establish required HIPAA Privacy Rule and HIPAA Security Rule obligations for the services provided.
Subcontractors and Downstream Vendors
A subcontractor of a Business Associate is subject to HIPAA when it creates, receives, maintains, or transmits protected health information on behalf of the Business Associate. Downstream vendors such as cloud hosting providers, managed service providers, data backup vendors, and document destruction companies fall within this scope when they handle protected health information. Written subcontractor agreements are used to flow required safeguards and use and disclosure limits to downstream parties.
Workforce Members and Agents
Workforce members include employees, volunteers, trainees, and other persons under the direct control of a HIPAA Covered Entity or Business Associate, whether paid or unpaid. Workforce members are required to follow organizational policies and procedures governing permitted uses and disclosures and required safeguards. Agents acting within the scope of an agency relationship can also implicate organizational compliance responsibilities when they handle protected health information under the entity’s control.
Hybrid Entities and Affiliated Covered Entities
Organizations that perform both HIPAA-covered functions and non-covered functions may operate as hybrid entities by designating healthcare components that are regulated under HIPAA. The hybrid structure limits protected health information access to the designated healthcare components and applies HIPAA controls within that scope. Separate legal entities under common ownership or control may form an affiliated covered entity when permitted conditions are met and the designation is documented.
Individuals not Covered by HIPAA
Patients, family members, and members of the public are not HIPAA Covered Entities or Business Associates solely because they possess health information. HIPAA regulates covered organizations and their contracted partners, not every recipient of health-related information. Other laws and contractual duties may restrict collection, use, disclosure, retention, or breach notification when HIPAA does not apply.