Healthcare Providers

This includes providers such as:

• Doctors
• Clinics
• Hospitals
• Physical, Occupational, and Speech Therapists
• Dentists
• Chiropractors
• Nursing Homes
• Pharmacies

Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.

Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. HIPAA covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf.  

Health care providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.

Health Plans

This includes:

• Health insurance companies
• HMOs
• Company health plans
• Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans’ health care programs

Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity.

Two types of government funded programs are not health plans:

• Those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and
• Those programs whose principal activity is directly providing health care, such as a community health center, or the making of grants to fund the direct provision of health care.

Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance.

Health Care Clearinghouses

Entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.  In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information. Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions.

Reference

U.S. Department of Health & Human Services

Health Information Privacy

OCR Privacy Rule Summary