All covered entities, along with third-party vendors and business associates, that have access to PHI. No matter the size or scope of the organization; if they are considered a covered entity, they are responsible for protecting PHI and they must perform periodic HIPAA Security Risk Assessments.