Covered Entities vs Business Associates: Who Must Comply with HIPAA

Covered Entities

Typically: health plans, healthcare clearinghouses, and healthcare providers who transmit health information in electronic form in connection with HIPAA standard transactions (see 45 CFR 160.103).

Business Associates

A person or entity that creates, receives, maintains, or transmits PHI on behalf of a CE for a function or activity regulated by HIPAA, or provides services involving PHI disclosure (claims, billing, data analysis, IT hosting, etc.). After HITECH/Omnibus, BAs are directly liable for Security Rule and specified Privacy/Breach duties.

Examples

How CyberSilo Helps

• CSA programmes for both CE and BA control libraries
• ThreatHawk monitoring evidence for BA-operated ePHI environments

Frequently Asked Questions

Who is a covered entity?

Health plans, healthcare clearinghouses, and certain healthcare providers that conduct standard electronic transactions — see 45 CFR 160.103.

Who is a business associate?

An entity that creates, receives, maintains, or transmits PHI for a CE (or provides services involving PHI), such as billers, cloud hosts, and many SaaS vendors.

Do BAs need BAAs?

Yes — CEs must obtain satisfactory assurances via BAAs; BAs also flow down to subcontractors that handle PHI.

Related HIPAA Resources

HIPAA hub · Certification myth · vs SOC 2 · CSA