HIPAA Covered Entity vs Business Associate: Who Counts as Each, What PHI Is, and What You Must Do

A health tech startup signs its first hospital customer. The hospital's procurement team sends two documents: a business associate agreement and a security questionnaire. The founder's question is simple: "We are not a hospital or an insurer. Does HIPAA even apply to us?"

If the product stores or processes patient information for the hospital, it does. The startup is a business associate. This guide explains the two roles HIPAA defines, how to tell which one you are, and what each one has to do.

Quick answer: A HIPAA covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction such as a claim. A business associate is a person or organization that performs work for a covered entity involving protected health information (PHI), such as a cloud, SaaS, billing or IT provider. Covered entities are regulated because of what they are. Business associates are regulated because of what they do with PHI, must sign a business associate agreement (BAA), and are directly liable for parts of the HIPAA Rules, including the Security Rule.

Covered Entity vs Business Associate: Side-by-Side

The Three Types of HIPAA Covered Entity

• Health care providers, such as doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, but only if they transmit health information electronically in connection with a transaction for which HHS has adopted a standard, such as claims, eligibility checks or payment.
• Health plans, such as health insurance companies, HMOs, company health plans, and government programs that pay for health care, including Medicare, Medicaid, and military and veterans health programs.
• Health care clearinghouses, which convert nonstandard health information into a standard format, or the reverse.

Some organizations are hybrid entities: a single legal entity with both covered and non-covered functions, such as a university with a student health clinic. A hybrid entity can designate its health care components, so HIPAA applies mainly to those parts.

Who Counts as a Business Associate

HHS gives examples of business associates, including:

• Cloud service providers that store or process ePHI
• EHR vendors, health app developers and SaaS platforms handling PHI for a covered entity
• IT contractors and managed service providers with access to ePHI
• Billing companies, third-party administrators, pharmacy benefit managers and transcription services
• CPA firms, attorneys and consultants whose services involve PHI
• Health information exchanges and e-prescribing gateways

Subcontractors count too. If your business associate passes PHI to a vendor, such as a hosting provider or a support tool, that vendor is a business associate of the business associate, and needs its own BAA.

Who is not a business associate

• Members of the covered entity's own workforce
• Health care providers receiving PHI for a patient's treatment
• Conduits that only transmit data, with no more than temporary storage, and do not regularly access it
• Banks processing ordinary payment transactions
• People whose access to PHI is only incidental, such as cleaners or electricians

What Counts as PHI

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: electronic, paper or oral. It covers information about a person's physical or mental health, the care they receive, or payment for that care, where the information identifies them or could reasonably be used to. ePHI is PHI in electronic form, and it is what the Security Rule protects.

Not everything is PHI. Employment records a covered entity holds as an employer, and education records covered by FERPA, are excluded. Health information that has been properly de-identified is no longer PHI.

The 18 HIPAA identifiers

Under the Safe Harbor method in 45 CFR 164.514(b), information is de-identified only when these identifiers are removed for the individual and their relatives, employers and household members:

What a Business Associate Agreement Must Include

Under 45 CFR 164.504(e) and the Security Rule, a BAA must, among other things:

• Describe the permitted and required uses and disclosures of PHI by the business associate
• Prohibit the business associate from using or disclosing PHI other than as the BAA allows or the law requires
• Require appropriate safeguards and compliance with the Security Rule for ePHI
• Require the business associate to report security incidents and breaches of unsecured PHI to the covered entity
• Require the same restrictions to flow down to subcontractors through their own BAAs
• Allow the covered entity to end the contract if the business associate materially breaches it

What Each Role Has to Do

Since the 2013 Omnibus Rule, business associates are directly liable for compliance with certain HIPAA requirements, not just their contracts. In practice, both roles need a working compliance program:

• Risk analysis. A documented Security Rule risk analysis of where ePHI lives and how it is protected, kept current. If you also run ISO 27001, much of the method carries over from your ISO 27001 risk assessment.
• Safeguards. Administrative, physical and technical safeguards, such as access control, audit logging, encryption and workforce training.
• Vendor management. BAAs with every business associate or subcontractor that touches PHI.
• Breach response. Procedures to assess incidents and notify on time. Business associates must notify the covered entity within 60 days of discovery at the latest, and many BAAs require faster.
• Documentation. Policies, procedures and records kept for six years.

For what penalties apply when this goes wrong, and how a HIPAA risk analysis is run, see our HIPAA compliance services page.

How Business Associates Prove HIPAA Compliance to Customers

There is no official HIPAA certification. HHS does not recognize private certificates, so business associates usually answer hospital and health plan security reviews with evidence:

Choosing between them? Compare SOC 1 vs SOC 2, see what HITRUST certification costs, or read about compliance for the healthcare industry. Software vendors can also see ISO 27001 for SaaS.

HIPAA Covered Entity and Business Associate FAQ

What is a covered entity under HIPAA?
A covered entity is one of three types of organization the HIPAA Rules apply to directly: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a transaction for which HHS has adopted a standard, such as claims or eligibility checks. The definitions are in 45 CFR 160.103.

What is a business associate under HIPAA?
A business associate is a person or organization, other than a member of the covered entity's workforce, that performs functions or services for a covered entity that involve creating, receiving, maintaining or transmitting protected health information. Examples include cloud providers storing ePHI, EHR and SaaS vendors, billing companies, IT providers, consultants and CPA firms. Subcontractors of business associates that handle PHI are business associates too.

What is the difference between a covered entity and a business associate?
A covered entity is subject to HIPAA because of what it is: a health plan, a clearinghouse or a provider that bills electronically. A business associate is subject to HIPAA because of what it does for a covered entity: work that involves PHI. Business associates must sign a business associate agreement and are directly liable for certain HIPAA requirements, including the Security Rule.

Can an organization be both a covered entity and a business associate?
Yes. A covered entity can also act as a business associate of another covered entity, for example a hospital that provides billing services to an unaffiliated physician practice. Each relationship is assessed separately.

What is PHI under HIPAA?
Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: electronic, paper or oral. It covers information about a person's health, care or payment for care that identifies them or could reasonably be used to identify them. Employment records held by a covered entity as an employer and education records covered by FERPA are excluded.

What are the 18 HIPAA identifiers?
Under the Safe Harbor de-identification method, these must be removed: names; geographic subdivisions smaller than a state; dates related to the individual except year; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers; full-face photos and comparable images; and any other unique identifying number, characteristic or code.

Who does not need a business associate agreement?
Common examples are members of the covered entity's own workforce, health care providers receiving PHI for treatment, conduits that only transmit data without regularly accessing it, banks processing normal payment transactions, and people such as cleaners whose access to PHI is only incidental. HHS guidance lists these exceptions.

How quickly must a business associate report a breach?
A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovering it. Many business associate agreements set a shorter deadline, so check your contract.

Is there a HIPAA certification for business associates?
No. HHS does not recognize any official HIPAA certification. Business associates usually show their safeguards to covered entity customers with a documented HIPAA risk analysis and evidence, and often with a SOC 2 report, HITRUST certification or ISO 27001 certificate. Accredify Global helps covered entities and business associates build that evidence.