A covered entity is a healthcare provider, healthcare clearinghouse, or health plan required to comply with the HIPAA rules. Business associates that provide services to covered entities must also comply with HIPAA regulations, if they create, receive, maintain, or transmit PHI on behalf of a covered entity. Business associates include third-party billing companies, medical transcription companies, and cloud storage providers.
Some examples of covered entities and business associates include:
Hospitals
Physicians' offices
Prescription delivery services
SaaS platforms for dentists
Health insurance marketplaces
Billing companies
Cloud storage providers
Covered entities and business associates must implement appropriate safeguards to protect the confidentiality, integrity, and availability of PHI, and to ensure that only authorized individuals have access to it.