HIPAA applies to covered entities and their business associates. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Business associates are any organizations or individuals that perform activities or services for a covered entity that involves the use or disclosure of PHI.