By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Covered Entity (HIPAA)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A covered entity is an organization or individual that must comply with HIPAA‘s Privacy, Security, and Breach Notification Rules. HIPAA defines three types: health plans, healthcare clearinghouses, and healthcare providers that electronically transmit health information in connection with certain standard transactions.
The HIMSS Dictionary describes covered entities as health plans, healthcare clearinghouses, and healthcare providers that send health information electronically as part of a HIPAA-regulated transaction, using the definitions in the HIPAA regulations at 45 CFR Parts 160 and 164.
| Covered Entity Type | Who It Includes | Example |
|---|---|---|
| Health Plans | Organizations that provide or pay for medical care | Health insurers, HMOs, Medicare, Medicaid, employer group health plans |
| Healthcare Clearinghouses | Entities that convert nonstandard health information into standard formats, or the reverse | A billing service that translates claims into standard transactions |
| Healthcare Providers | Providers that conduct HIPAA standard transactions electronically | Hospitals, physicians, nurse practitioners, pharmacies, and clinics that bill electronically |
| Business Associates | Not covered entities, but directly liable for certain HIPAA requirements | A cloud EHR host, a transcription service, or a billing vendor |
| Hybrid Entity | A single legal entity with both covered and noncovered functions | A university with a health clinic and other non-health departments |
⚠️ Exam Alert: A provider becomes a covered entity by electronically conducting standard transactions, such as claims or eligibility checks, not simply by providing care. Business associates perform services for covered entities involving PHI and must sign business associate agreements. Many consumer health apps are not covered by HIPAA unless offered by or on behalf of a covered entity.
🌐 Why It Matters: Real-World Healthcare IT Context
The covered entity concept defines HIPAA’s reach. HIPAA applies to the organizations most directly involved in healthcare payment and delivery, and to the business associates that handle PHI on their behalf. Organizations that fall outside these categories may handle health information without being subject to HIPAA at all.
For providers, the trigger is electronic transactions. A provider that submits claims, checks eligibility, or conducts other standard transactions electronically, directly or through a billing service, is covered. Today almost all hospitals, physician practices, and pharmacies meet this definition, but some cash-only providers may not.
Business associates extend HIPAA’s protections. Under the HITECH Act and the 2013 Omnibus Rule, business associates became directly liable for compliance with parts of HIPAA, including the Security Rule. Covered entities must have business associate agreements that describe permitted uses and require safeguards, and business associates must have similar agreements with their subcontractors.
Hybrid entities allow organizations with mixed functions to designate which components are covered. A university, a county government, or an employer that operates a clinic may designate its healthcare components, then apply HIPAA requirements to those components and protect information shared with the rest of the organization.
Gaps remain. Many consumer apps, wearables, and websites collect health information without being covered entities or business associates. Employment records held by a covered entity in its role as employer are also excluded from the definition of PHI. Other laws, such as Federal Trade Commission rules and state privacy laws, may apply instead, but patients often assume HIPAA protects all health data.
Covered status shapes responsibilities. Covered entities must give notices of privacy practices, honor patients’ rights to access and amend records, follow minimum necessary standards, conduct security risk analyses, and notify individuals and HHS of breaches of unsecured PHI. HHS’s Office for Civil Rights enforces these requirements.
Determining status can be complex. Organizations sometimes need legal review to decide whether they are covered entities, business associates, or neither, especially with new digital health business models. HHS provides guidance and tools to help organizations make these determinations.
Common covered entity confusion:
- Assuming all health information is protected by HIPAA
- Not recognizing when a vendor is a business associate
- Missing or outdated business associate agreements
- Unclear hybrid entity designations
- Assuming patient-directed apps are business associates
- Treating employment records as PHI
Practices for clear HIPAA scope:
- Documented determination of covered entity status
- Inventory of business associates with current agreements
- Clear hybrid entity designations where applicable
- Privacy and security policies tailored to covered functions
- Patient education about apps and non-HIPAA data
- Regular review as services and vendors change
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses working in covered entities carry HIPAA obligations into every interaction involving patient information.
At the Bedside
Hospitals, clinics, home health agencies, and other organizations that bill electronically are covered entities, so nurses working there follow HIPAA policies for using, sharing, and protecting PHI. Discussing patients only as needed for care, protecting screens and documents, and verifying identity before sharing information are everyday applications.
Patients sometimes ask whether an app or device they use is covered by HIPAA. Nurses can explain that information shared with the care team through organizational tools is protected, while consumer apps may not be, and encourage patients to review an app’s privacy policy.
In Clinical Workflow
When nurses share information with other covered entities for treatment, such as during referrals or transfers, HIPAA generally permits these disclosures without patient authorization. Sharing with entities that are not covered, such as employers or schools, usually requires authorization or another specific permission.
Nurses in school health, occupational health, or research settings may work in organizations that are not covered entities or that are hybrid entities. Understanding which rules apply helps protect information appropriately.
Vendors who access patient information, such as equipment technicians or software support staff, should be operating under business associate agreements. Concerns about unknown vendors accessing records should be raised with privacy or security teams.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, many outside parties, including vendors, consultants, and support staff, gain access to PHI. Business associate agreements and confidentiality agreements should be in place before access is granted.
At-the-elbow support analysts, often contracted, work under these agreements and follow the same privacy expectations as staff. Reinforcing HIPAA practices during the busy Go-Live period helps prevent accidental disclosures.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Covered entities appear in HIPAA and privacy questions:
| CAHIMS Domain | How Covered Entities Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA scope; HITECH; consumer apps and non-HIPAA data |
| Clinical Informatics | Disclosures for treatment; patient education about apps |
| Healthcare Information & Systems Management | Business associate oversight, vendor access, hybrid entity design |
| Management & Leadership | Compliance programs, legal determinations, contracts, enforcement |
Key Terms to Know Alongside Covered Entity
- Business Associate — a person or entity that performs services for a covered entity involving PHI
- Business Associate Agreement (BAA) — a contract defining a business associate’s HIPAA obligations
- Hybrid Entity — a single legal entity with designated covered and noncovered components
- Standard Transaction — an electronic exchange, such as a claim, for which HIPAA adopted standards
- Protected Health Information (PHI) — individually identifiable health information held by covered entities and business associates
- Office for Civil Rights (OCR) — the HHS office that enforces HIPAA
HIMSS Organizational Position
HIMSS engages on health privacy policy, including protections for health information outside HIPAA, and supports organizations through privacy and security education. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — Covered Entities and Business Associates https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
- eCFR — 45 CFR 160.103, Definitions https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
- HHS — Business Associates https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- HHS — Health Information Technology (HIPAA) https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/index.html
- CMS — Administrative Simplification https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification
- HIMSS — Public Policy & Advocacy https://www.himss.org/public-policy-advocacy-overview
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply