{"head":{"title":"What Is a Covered Entity Under HIPAA? | OceanLab","description":"A HIPAA covered entity is a health plan, a clearinghouse or a provider that bills electronically. Who counts, what it means for vendors and mistakes.","canonical":"https://oceanlab.in/glossary/covered-entity"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"covered entity","path":"/glossary/covered-entity"}],"slug":"covered-entity","term":"Covered entity (HIPAA)","aka":["HIPAA covered entity"],"category":"Compliance","short":"Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions.","body":[["45 CFR 160.103 lists three kinds of covered entity: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with a HIPAA transaction, such as billing insurance."],["HIPAA applies to covered entities and to their ",{"href":"/glossary/business-associate","text":"business associates"},". A company that is neither, such as a fitness app people sign up for themselves, is usually outside HIPAA, though other rules such as the FTC Health Breach Notification Rule may apply."]],"why":["Whether your customer is a covered entity decides whether the health data your software handles is ",{"href":"/glossary/phi","text":"PHI"}," and whether you need a ",{"href":"/glossary/baa","text":"BAA"},". It is the first question in any health software project."],"example":["A dental practice that bills insurers electronically is a covered entity. A wellness app that a person downloads to track sleep is not. The same kind of data can be PHI in the first case and outside HIPAA in the second."],"inBuild":["Discovery for a health build starts by listing who the customers are. If any are covered entities, HIPAA safeguards are part of the scope from the first milestone, not added later."],"mistakes":[["Assuming every healthcare business is a covered entity. A cash-only provider that never bills electronically may not be."],["Assuming HIPAA does not apply because your company is not a covered entity. Business associates are covered too."],["Ignoring state privacy laws and the FTC rule when HIPAA does not apply."]],"related":[{"href":"/glossary/business-associate","label":"Business associate (HIPAA)","detail":"A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity."},{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/baa","label":"BAA (business associate agreement)","detail":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI."},{"href":"/glossary/ephi","label":"ePHI (electronic protected health information)","detail":"Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"16 CFR Part 318, FTC Health Breach Notification Rule (eCFR)","url":"https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}