A HIPAA covered entity is the organization directly providing, paying for, or clearing healthcare services, while a business associate is a vendor or partner that handles protected health information for that covered entity. Get this distinction wrong and privacy duties get messy fast. A clinic, hospital, health plan, or billing clearinghouse may be a covered entity. A cloud host, billing vendor, transcription service, analytics firm, or claims processor may be a business associate.
TLDR: A covered entity has the direct HIPAA duty to protect patient data because it provides care, pays for care, or processes healthcare transactions. A business associate supports that entity and touches protected health information, so it must sign a Business Associate Agreement and follow key HIPAA rules. For example, if a 12 physician clinic sends 8,000 patient billing records each month to an outside coding company, the clinic is the covered entity and the coding company is the business associate. One missed agreement can turn a routine vendor setup into a reportable compliance problem.
What Is a HIPAA Covered Entity?
A HIPAA covered entity is one of the main organizations regulated under HIPAA. These entities create, receive, maintain, or transmit protected health information, often called PHI, in connection with healthcare services or payment.
HIPAA groups covered entities into three main categories:
- Healthcare providers: Doctors, dentists, hospitals, pharmacies, psychologists, urgent care centers, nursing homes, and similar providers that conduct standard electronic transactions.
- Health plans: Health insurance companies, HMOs, Medicare, Medicaid, employer sponsored group health plans, and certain government health programs.
- Healthcare clearinghouses: Organizations that process nonstandard health data into standard formats, or the reverse, for billing and claims.
The key point is control. Covered entities usually have the direct patient, member, or claims relationship. They collect clinical notes, insurance details, Social Security numbers, addresses, lab results, prescription data, and payment records.
What Is a Business Associate?
A business associate is a person or company that performs work for a covered entity and needs PHI to do that work. The business associate is not usually treating the patient or paying the claim directly. It supports the process.
Common business associates include:
- Medical billing companies that submit claims for providers.
- Cloud storage providers that host medical records.
- IT support firms with access to patient systems.
- Law firms handling healthcare legal matters using PHI.
- Accounting firms reviewing patient payment data.
- Transcription companies converting physician dictation into notes.
- Data analytics vendors analyzing patient trends or costs.
- Practice management software providers that store or process PHI.
The catch is that “vendor” does not always mean “business associate.” A janitorial company that never sees PHI may not be one. A shredding company that destroys patient files likely is. The test is simple: Does the vendor create, receive, maintain, or transmit PHI for a covered function? If yes, treat it seriously.
Covered Entity vs Business Associate: The Main Differences
The difference sounds simple, but it causes plenty of confusion during vendor onboarding. Honestly, it feels like half the work is not the contract itself, but figuring out who is actually responsible for what.
| Question | Covered Entity | Business Associate |
|---|---|---|
| Primary role | Provides care, pays for care, or processes healthcare transactions | Supports a covered entity using PHI |
| Patient relationship | Usually direct | Usually indirect |
| HIPAA duties | Must comply with Privacy, Security, and Breach Notification Rules | Must comply with applicable Security and Breach Notification duties, plus contract terms |
| Required agreement | Must obtain agreements from business associates | Must sign and follow a Business Associate Agreement |
| Examples | Hospital, insurer, pharmacy, clinic | Billing vendor, cloud host, IT vendor, transcription service |
The Business Associate Agreement Is Not Optional
A Business Associate Agreement, often called a BAA, is the contract that sets HIPAA privacy and security expectations between a covered entity and a business associate. It tells the vendor what it can and cannot do with PHI.
A solid BAA usually covers:
- Permitted uses of PHI and clear limits on other uses.
- Security safeguards for electronic PHI.
- Breach reporting timelines and notice requirements.
- Subcontractor controls if the vendor uses other vendors.
- Return or destruction of PHI when the relationship ends.
- Access and audit cooperation if regulators ask questions.
A handshake is not enough. A purchase order is not enough. A generic privacy policy is not enough. If PHI is involved, the BAA needs to be in place before the work starts.
Why the Distinction Matters
The covered entity versus business associate distinction affects daily operations. It decides who trains staff, who tracks access, who reports breaches, who signs agreements, and who answers patient privacy questions.
For covered entities, the wrong classification can lead to vendor gaps. For business associates, it can mean taking on legal duties they did not price into the service. That gets expensive. It also slows down sales, onboarding, and renewals.
Consider a small cardiology practice using a scheduling app. If the app only shows public office hours, HIPAA may not apply. If it stores patient names, appointment reasons, phone numbers, and provider notes, the app provider may be a business associate. That one feature changes the compliance burden.
Practical Examples
Example 1: Hospital and cloud provider. The hospital is the covered entity. The cloud provider stores electronic medical records. Since the provider maintains PHI, it is a business associate.
Example 2: Health insurer and claims analytics firm. The insurer is the covered entity. The analytics vendor studies claims trends using member data. The vendor is a business associate.
Example 3: Clinic and cleaning service. The clinic is the covered entity. The cleaning company empties trash and mops floors, with no intended access to PHI. It may not be a business associate, though the clinic should still prevent papers from being left exposed.
Example 4: Doctor and answering service. The physician practice is the covered entity. The answering service takes patient calls, records symptoms, and sends messages to the doctor. That service is a business associate.
Subcontractors Can Also Be Business Associates
Business associates often use their own vendors. Those vendors may become business associate subcontractors if they handle PHI. For example, a billing company may use a cloud backup service. If that backup service stores PHI, it needs its own agreement with the billing company.
This chain matters. HIPAA duties follow the data. A covered entity cannot ignore the issue just because the PHI moved two vendors away. Each party should know where the data goes, who can access it, and how it is protected.
Common Mistakes to Avoid
- Assuming every vendor is safe because it has a privacy policy. Privacy policies are not the same as BAAs.
- Signing a BAA with no security review. The paper helps, but weak access controls still create risk.
- Forgetting subcontractors. PHI often moves through hosting, support, email, and backup systems.
- Using consumer tools for patient data. Free file sharing or messaging tools may not support HIPAA needs.
- Waiting until after go live. Fixing data sharing after launch is slower and more painful.
Quick Test: Which One Are You?
Ask these questions:
- Do you provide healthcare, pay for healthcare, or process standard healthcare transactions?
- Do patients or members give you health information directly?
- Do you handle PHI only because another healthcare organization hired you?
- Do you store, view, transmit, analyze, or support systems containing PHI?
If the first two answers are yes, you may be a covered entity. If the last two answers are yes, you may be a business associate. Some organizations can be both, depending on the service line. A hospital may be a covered entity for patient care, while a separate service it sells to other providers could create business associate duties.
Bottom Line
A covered entity owns the main healthcare relationship. A business associate supports that relationship and handles PHI along the way. Both must treat patient data with care, but their duties start from different places.
The safest move is simple: map where PHI enters, where it goes, who touches it, and which contracts apply. If a vendor can access PHI, do not guess. Classify the role, sign the right agreement, and check the security controls before data starts moving.