Written and maintained by CASRAI Editorial Board
Last updated
A HIPAA covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information in electronic form in connection with a transaction covered by the HIPAA rules. Whether an organization is one decides whether the Privacy Rule applies to it at all. For a university or health system, the more useful question is often narrower: which parts of the organization are covered, and who has documented that choice.
What a covered entity is under 45 CFR 160.103
The definition sits in 45 CFR 160.103, as checked on the eCFR on 2026-10-29 (45 CFR 160.103). It says a covered entity means: (1) a health plan; (2) a health care clearinghouse; or (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by that subchapter. There is no fourth category and no size threshold in that text. The category you fall into, and what you do, decide the answer.
The term matters because it is the anchor for the rest of the rules. The same section defines a business associate only “with respect to a covered entity”, so a vendor or collaborator’s status is derived from a covered entity’s, not the other way around. For the HIPAA overview, see the HIPAA dictionary entry and the HIPAA Privacy Rule entry.
The three categories of covered entity
Health plans
Section 160.103 defines a health plan as an individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the Public Health Service Act, 42 U.S.C. 300gg-91(a)(2)). The CMS covered-entities page, last modified 2026-03-16 and checked on 2026-10-29, lists health insurers, HMOs, employer-sponsored plans, and government programs that pay for care, such as Medicare, Medicaid, and military and veterans’ programs (CMS, Covered Entities).
Health care clearinghouses
A clearinghouse is a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and “value-added” networks and switches, that does either of two things: (1) processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction; or (2) receives a standard transaction from another entity and processes health information into nonstandard format or content for the receiving entity. CMS describes the same role as converting nonstandard health information into standard formats for other organizations.
Health care providers
Under 160.103 a health care provider includes a provider of services (section 1861(u) of the Social Security Act), a provider of medical or health services (section 1861(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. CMS gives examples: doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies. Being a provider is not enough on its own, as the next section shows.
The electronic-transaction test for providers
A provider is a covered entity only if it “transmits any health information in electronic form in connection with a transaction covered by this subchapter.” CMS puts it in practical terms: providers who submit HIPAA transactions, such as claims, electronically. Read literally, the definition has two parts that both have to be true: the person furnishes, bills, or is paid for health care, and the person transmits health information electronically in connection with a covered transaction. A clinic that never makes such a transmission is outside the third category as the text is written.
The test is about the organization’s own conduct. It does not turn on whether the organization handles patient information at all, and it does not turn on whether it calls itself a health care organization.
Hybrid entities and health care components
This is the part that matters most to research institutions, because a university can contain a clinic, a pharmacy, a billing office, and a dozen units that are none of those. Under 45 CFR 164.105 (checked 2026-10-29, 45 CFR 164.105), the Privacy Rule requirements apply only to the entity’s health care components. A component qualifies when it performs the functions of a health plan, health care provider, or health care clearinghouse.
- Designation is a documented act. A hybrid entity must designate its health care components and document the designation.
- Scope is limited to covered functions. The designation must include any component that would meet the definition of a covered entity or business associate, and a component may be included only to the extent that it performs covered functions.
- The whole entity stays responsible. The covered entity, meaning the hybrid as a whole, has the responsibility of complying with the part for enforcement purposes, and must meet the section’s requirements on business associate arrangements and other organizational requirements (164.314 and 164.504).
- Records are kept. The designation must be maintained as a written or electronic record, and the record retained for 6 years.
Affiliated covered entities
Section 164.105(b) lets legally separate covered entities that are affiliated designate themselves as a single covered entity, but only if all of the covered entities designated are under common ownership or control. As with a hybrid designation, the affiliated designation must be documented and the record retained.
Steps to determine whether you are a covered entity
- Identify the function. Does the organization, or a unit of it, act as a health plan, a clearinghouse, or a provider as defined in 160.103?
- Apply the transaction test to providers. Does the provider transmit health information in electronic form in connection with a covered transaction, such as an electronically submitted claim?
- Check the organization’s structure. If only some units perform covered functions, the hybrid-entity rules in 164.105 apply. If several legally separate entities share ownership or control, consider whether to designate an affiliated covered entity.
- Document the designation. Keep the hybrid or affiliated designation in writing or electronically, and retain it for 6 years.
- Use the official tool when unsure. The CMS covered-entities page links a “Covered Entity Decision Tool” (PDF) for organizations that are not sure whether they are covered.
Common mistakes
- Treating a business associate as a covered entity, or the reverse. The two are defined separately in 160.103; a business associate is defined relative to a covered entity, and is not one of the three covered-entity categories.
- Treating every unit of a hybrid organization as covered. Section 164.105 limits the Privacy Rule to designated health care components, and a component is included only to the extent it performs covered functions.
- Assuming a designation has been made because the units are obviously covered. The designation has to be documented and kept.
- Assuming a health care provider is automatically covered. The third category adds the electronic-transaction condition.
- Forgetting that the hybrid as a whole still answers for compliance. Designating components narrows where the Privacy Rule applies; it does not move enforcement responsibility away from the entity.
Related terms in the covered-entity definitions
| Term | What the source says | Source |
|---|---|---|
| Health plan | An individual or group plan that provides, or pays the cost of, medical care. | 45 CFR 160.103 |
| Health care clearinghouse | An entity that converts nonstandard health information into standard data elements or transactions, or the reverse, for another entity. | 45 CFR 160.103 |
| Health care provider | A provider of services or of medical or health services, and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. | 45 CFR 160.103 |
| Hybrid entity | An entity that designates and documents its health care components; the Privacy Rule applies only to those components. | 45 CFR 164.105 |
| Health care component | A component that performs the functions of a health plan, health care provider, or health care clearinghouse. | 45 CFR 164.105 |
| Affiliated covered entity | Legally separate covered entities under common ownership or control that designate themselves as a single covered entity. | 45 CFR 164.105(b) |
What to read after you know your status
Once status is settled, the next questions are usually about vendors and data. The business associate agreement guide for research covers the vendor side, the HIPAA compliance checklist covers program steps, and the 18 HIPAA identifiers guide covers de-identification identifiers. If substance use disorder records are in play, 42 CFR Part 2 vs HIPAA compares the two regimes, and HIPAA-aware vs HIPAA-compliant covers a common vendor-marketing distinction.
Frequently asked questions
Is a business associate a covered entity?
Not by virtue of being a business associate. Section 160.103 lists three categories of covered entity (health plan, clearinghouse, qualifying provider) and defines a business associate separately, “with respect to a covered entity”. An organization can be both only if it independently meets a covered-entity definition.
Is a university a covered entity?
It depends on what the university does. If it contains units that act as a health care provider that transmits health information electronically in connection with a covered transaction, or a health plan, it can be a covered entity. Section 164.105 then lets it operate as a hybrid entity, designating and documenting the health care components to which the Privacy Rule applies, while the entity as a whole remains responsible for compliance.
Do researchers count as covered entities?
The definitions do not turn on the job title of “researcher”. A person or organization is a covered entity if it is a health plan, a clearinghouse, or a health care provider that makes covered electronic transmissions. A researcher who is also part of a designated health care component is part of that component’s covered function; a research unit that performs no covered function is outside the designation.
What if my clinic never bills electronically?
The provider category requires transmitting health information in electronic form in connection with a covered transaction. If the organization does not do that, it does not meet the third category as written. Confirm the facts against the definition, or use the CMS decision tool, before relying on that conclusion.
Sources
- eCFR, 45 CFR 160.103, Definitions, checked 2026-10-29 (page shows amendment cite 91 FR 14404, March 24, 2026).
- eCFR, 45 CFR 164.105, Organizational requirements, checked 2026-10-29.
- Centers for Medicare & Medicaid Services, Covered Entities, page last modified 2026-03-16, checked 2026-10-29.
The regulatory text above is paraphrased from the sources above as of the dates shown. Regulations are amended, so check the current text for any decision that depends on it.
