Yes, HMOs and CCRCs are considered covered entities. These organizations have sensitive, private data that require compliance with cybersecurity protection.