What are Covered Entities in HIPAA

Health Plans

In the realm of HIPAA-covered entities, the category of Health Plans plays a vital role and includes a diverse range of organizations involved in funding and managing healthcare services. This category encompasses health insurance companies, which are responsible for offering health insurance policies to individuals and groups, processing claims, and managing the personal health information of their policyholders. Health Maintenance Organizations (HMOs) also fall under this category. They provide or arrange managed care for health insurance and act as intermediaries between healthcare providers and patients, coordinating care and managing costs, thereby handling substantial amounts of protected health information (PHI). Employer-sponsored health plans, another significant component, are offered by many employers as part of their employee benefits. These plans, whether fully insured or self-funded, engage in standard electronic transactions and are thus subject to HIPAA regulations. Additionally, government programs like Medicare and Medicaid, which provide healthcare coverage to specific demographics such as older adults and low-income individuals, are also included in this category. Each of these entities, due to their extensive handling and processing of PHI, must adhere to HIPAA’s Privacy and Security Rules, ensuring the implementation of appropriate safeguards for the protection of health information. Their compliance with these rules is crucial for maintaining the confidentiality, integrity, and availability of PHI, thus playing a pivotal role in the broader healthcare system.

Healthcare Providers

Healthcare Providers form a broad category of HIPAA-covered entities, encompassing a wide range of professionals and facilities that transmit health information electronically in transactions regulated by the U.S. Department of Health and Human Services. This group includes doctors, who handle patient health records and communicate electronically for various purposes such as billing and referrals. Clinics also fall under this category, managing electronic health records and patient data for a multitude of health services. Psychologists, dentists, and chiropractors, who provide specialized medical services and maintain electronic health information, are also considered healthcare providers under HIPAA. Nursing homes, which care for elderly or disabled individuals and handle sensitive health information electronically, are required to comply with HIPAA standards. Pharmacies, integral to the healthcare system, manage electronic patient prescriptions and health records, thereby falling into this category. All these entities, by virtue of their electronic transactions involving health information, are mandated to follow HIPAA’s Privacy and Security Rules to protect patient data and maintain confidentiality and integrity in the healthcare system.

Healthcare Clearinghouses

Healthcare Clearinghouses play a specialized yet crucial role in the healthcare system under HIPAA regulations. These entities primarily act as intermediaries who process health information they receive from other entities, transforming it from a nonstandard format into a standard electronic format, or vice versa. This process is fundamental for ensuring the uniformity and interoperability of health data across different healthcare entities.

Examples of healthcare clearinghouses include:

• Billing Services: These services receive billing information from healthcare providers and convert it into the appropriate billing format for insurance claims. They play a pivotal role in the healthcare revenue cycle, ensuring that claims are processed efficiently and accurately.
• Repricing Companies: These entities often work with health insurance plans to determine the actual payment amounts for healthcare services. They receive charge information and adjust it according to the contractual rates negotiated between healthcare providers and insurers.
• Community Health Management Information Systems: These systems collect data from various healthcare entities and process it for community health management purposes. They are instrumental in providing aggregated health data, which can be used for monitoring public health trends and improving healthcare delivery at the community level.
• Value-Added Networks (VANs): VANs facilitate the transmission of healthcare data by converting it into standardized formats and providing additional services such as message encryption, secure email, and data storage. They enhance the efficiency and security of data transmission between healthcare entities.

Each of these clearinghouses, through their processing and conversion of health information, plays a vital role in maintaining the fluidity and integrity of health data exchanges. They are subject to HIPAA’s Privacy and Security Rules, which mandate the protection of PHI during these processes. By ensuring standardized, accurate, and secure handling of health information, healthcare clearinghouses are instrumental in the broader ecosystem of healthcare data management.

These covered entities are responsible for implementing and maintaining policies and procedures to protect the privacy and security of PHI, complying with HIPAA’s Privacy Rule and Security Rule. They must also provide patients with certain rights regarding their health information, such as the right to access their records and request corrections.

In addition to these primary categories, HIPAA also applies to “business associates” – individuals or entities that perform certain functions or activities that involve the use or disclosure of PHI on behalf of, or provide services to, a covered entity. The extension of HIPAA obligations to business associates through the HITECH Act has broadened the scope of compliance requirements beyond the traditional boundaries of healthcare organizations. Carosh Compliance Solutions is a great resource for covered entities. Carosh is able to assess your associates and help you stay HIPAA compliant. To find out more about how Carosh can help, click here.

Q&A

What is the minimum necessary rule for HIPAA?
The minimum necessary rule under HIPAA mandates that covered entities and their business associates take reasonable steps to limit the use, disclosure, and request of Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose. This principle applies to routine and non-routine uses and disclosures. The idea is to protect patient privacy by only sharing the amount of information necessary for a specific task or purpose.

What is not a HIPAA covered entity?
Non-healthcare-related entities are typically not considered HIPAA covered entities. This includes most employers, life insurers, workers’ compensation carriers, many schools and school districts, many state agencies like child protective services, and most law enforcement agencies. Also, technology companies that do not specifically handle PHI on behalf of a covered entity or business associate do not fall under the category of HIPAA covered entities.

What group is not one of the three covered entities?
The three main groups classified as covered entities under HIPAA are healthcare providers, health plans, and healthcare clearinghouses. Any group outside these categories, such as technology service providers (unless they specifically handle PHI as business associates), educational institutions, public health authorities, and employers in their capacity as employers, are not considered covered entities.

Why are they called covered entities?
The term “covered entities” in HIPAA refers to organizations or individuals that are covered by HIPAA regulations. These entities are “covered” in the sense that they are subject to HIPAA’s rules and must comply with its requirements regarding the use and disclosure of PHI. The term distinguishes these entities from others that might interact with PHI but are not directly subject to HIPAA’s rules.

Is Pharma a covered entity?
Pharmaceutical companies, generally known as “Pharma,” are not automatically considered covered entities under HIPAA. However, if a pharmaceutical company operates a health plan, a healthcare clearinghouse, or provides healthcare in a way that involves electronic transactions covered by HIPAA, it could be classified as a covered entity. In many cases, pharmaceutical companies act as business associates when they work with covered entities and thus are subject to certain HIPAA rules.

Which principle requires covered entities?
HIPAA sets several principles that covered entities must adhere to, such as the Privacy Rule, Security Rule, and the Breach Notification Rule. The Privacy Rule requires covered entities to protect the privacy of PHI, the Security Rule requires them to ensure the confidentiality, integrity, and availability of electronic PHI, and the Breach Notification Rule requires them to report certain types of PHI breaches. These principles collectively ensure the protection of patient health information under HIPAA’s framework.