A covered entity is an organization that provides various medical services to patients. This can be a doctor, pharmacy or health insurance company. All of them have access to protected health information (PHI). A business associate is a company hired by a covered entity to perform tasks like data analysis and quality assurance. It has access to PHI, meaning it needs to follow HIPAA.