Who Does HIPAA Apply To

Who Does HIPAA Apply To

Key Points

  • HIPAA is a US Federal Law that uses a series of criteria to determine if an entity must be HIPAA compliant or not.
  • HIPAA generally applies to covered entities, business associates, hybrid entities, subcontractors, and researchers.
  • If your cloud-hosted company falls under any of the above mentioned categories, certain business contracts and practices need to be modified to reflect HIPAA compliance.

Introduction

Looking for answers to questions like who does HIPAA apply to? Or ‌ whether HIPAA applies to you and your employees? 

The answers to these questions simply depend on whether your cloud-hosted company meet the criteria of HIPAA compliance.

HIPAA, also known as the Health Insurance Portability and Accountability Act, is a US Federal Law that ensures baseline privacy and security standards for Protected Health Information (PHI). 

It uses a series of criteria to determine if an entity needs to be HIPAA compliant. And in case any covered entity violates HIPAA regulations (knowingly or unknowingly), it can face civil action lawsuits, criminal charges, and hefty monetary penalties ranging between $100-$1.5 million per violation.

This article discusses who HIPAA applies to, and will help you figure out if your cloud-hosted company is a covered entity as per HIPAA regulations. 

HIPAA Who Does It Apply To?

who does hipaa apply to

The HIPAA rules apply to any individual, healthcare organization, and a cloud-hosted company that meets the definition of a covered entity as stated in HIPAA guidelines. 

Following are the five distinct entities that need to be HIPAA compliant:

1. Covered Entities

There are various kinds of entities that fall under the Covered Entity category, as described below.

  • Healthcare Providers – Any healthcare organization or institution that collects protected health information (PHI) must be HIPAA compliant. This includes doctors, dentists, psychologists, physiologists, clinics, pharmacies, nursing homes, etc.
  • Healthcare Plans – Any corporations that give healthcare plans such as health insurance companies, group health plans, health maintenance organizations, and government-funded health plans like Medicare & Medicaid are a covered entity.
  • Healthcare ClearinghousesAll healthcare clearinghouses that convert PHI data into a uniform format for electronic transmission also fall under covered entities.

2. Business Associates

A business associate is any person or entity that executes certain operations or responsibilities that involve disclosing or using the PHI, either on behalf of or as a service provider to a covered entity. 

Following are some primary examples of business associates:

  • An external or independent hospital consultant who conducts evaluations
  • An external administrator who helps healthcare plan to process claims
  • A third-party CPA firm that requires access to the PHI for providing its accounting services to covered entities

Business associates don’t require direct interaction with patients to perform their services for covered entities. However, the covered entities must execute a business associate agreement (BAA) to ensure their partnered business associates safeguard the shared PHI as per HIPAA regulations.

In addition, business associates are directly liable for any HIPAA violation and are subject to the same penalties that apply to covered entities. 

3. Subcontractors

who does hipaa not apply to

A subcontractor is an individual or entity that creates, maintains, and transmits health information on behalf of a business associate. In fact, a HIPAA subcontractor bears the same legal responsibilities as any business associate we discussed earlier.

For example, a covered entity’s business associate may hire an external agency to destroy documents containing the PHI or avail a cloud service to store & process the PHI. In both scenarios, the external agency falls under the Subcontractor category and is required to comply with most of the HIPAA regulations.

4. Hybrid Entities

A hybrid entity usually conducts both HIPAA-covered and non-covered tasks as a business. 

A perfect example of this is any large organization that has a self-insured healthcare plan for its employees. In this type of organization, only a part of the company is considered a covered entity, and only that ‌part (also called the health care component) is subject to HIPAA compliance. 

Other examples of hybrid entities include grocery stores that have a pharmacy and universities that have a medical center. 


An organization that is a hybrid entity must ensure that its health care component does not disclose the PHI to any non-covered component within the organization.

5.  Researcher

HIPAA regulations allow covered entities to share PHI with researchers if patients have given their consent to disclose and use their PHI for research ‌. In such cases, there is no need to sign a business associate agreement. However, the covered entity must draw and enter a data use agreement with the partnered researcher before disclosing the PHI. 

The data use agreement helps to instill a satisfying assurance that you will strictly adhere to the HIPAA compliance guidelines for the ‌limited data set.

Who Does HIPAA Not Apply To?

Just as there are many individuals and businesses required to comply with HIPAA, there are also many that are not required to. And even then, sometimes health information is still available to these people and businesses. 

Following are some examples of those who aren’t required to comply with HIPAA regulations:

  • Term & life insurance companies
  • Gyms and fitness studios
  • Schools & districts
  • Health and fitness mobile apps
  • The majority of law enforcement firms
  • State agencies like child welfare 
  • Certain government departments
  • Employers
  • Workers’ compensation insurance companies

More examples of such entities are available on HHS Guidance Materials for Consumers.

Does HIPAA Apply to Everybody?

As per GDPR Compliance, the Department of Health and Human Services (HHS) can only enforce HIPAA penalties against covered entities and business associates as stated in the HIPAA compliance regulations. 

As per the defined regulations, covered entities include all healthcare organizations, healthcare clearinghouses, and health plans who engage in electronic transmissions of the PHI. 

Now, this definition of covered entities is fairly broad and covers not only hospitals, clinics, and insurance companies but also private companies, non-profit organizations, and even government agencies that provide some kind of healthcare services.

The entire scope of parties does not end here. Many employers across the world have discovered that they fall under the covered entities category because of functions or activities such as a group health plan for all employees.

Though these employers urge to be treated as hybrid entities to limit HIPAA restrictions, these employers are required to conduct the usual HIPAA compliance checklist activities, even as a hybrid entity.

Aside from employers, HIPAA applies to individuals and cloud-hosted companies that require the use of the PHI for providing services to covered entities. These individuals and cloud-hosted companies fall under the business associates category. While they’re not liable for HIPAA compliance penalties, they are required to renegotiate certain business contracts along with additional business practices to reflect the HIPAA privacy compliance requirements. 

Conclusion

Now that you have the answer to, “who does HIPAA apply to” and whether your cloud-hosted company needs to be HIPAA compliant, you’re halfway through ensuring HIPAA compliance. 

That said, if you find it difficult to navigate the complicated legislation of HIPAA correctly, we’ve got you covered. Sprinto, an automated compliance software, can help to become HIPAA compliant with minimal fuss. For more information, please visit our website.

FAQ: Who Does HIPAA Laws Apply To?

Who does HIPAA apply to?

HIPAA applies to every person, healthcare organization, and a cloud-hosted company that requires the access and use of protected health information (PHI) of patients as declared in the HIPAA compliance guidelines.

What is considered Protected Health Information (PHI)?

Protected health information (PHI) includes patients’ demographic information, medical history, laboratory results, insurance information, health conditions, and any other data that can help to identify, locate, or contact an individual.

Who does HIPAA not apply to?

Even though health information is available at times, HIPAA still does not apply always to schools, term & life insurance companies, gyms & fitness studios, health and fitness mobile apps, most law enforcement firms, and certain government departments. You can find more examples of such at HHS Guidance Materials for Consumers.

What if a covered entity violates HIPAA regulations by accident?

Unfortunately, it is impossible to prevent every accidental violation of HIPAA regulations. And as far as penalty is concerned, the circumstances, along with the assessment of the damage caused by the accidental violation, will determine the outcome in terms of penalty. 

Does HIPAA still apply during emergencies?

If the president declares a national emergency or any time the Department of Health and Human Services (HHS) declares public health emergencies, penalties against non-compliant covered entities can be waived. Although, the waiving of the HIPAA penalty will only apply to specific provisions of the HIPAA privacy rule and not the Privacy Rule in its entirety. 

Posted in:

Cybersecurity SaaS Bussiness Security

Photo of author

Pritesh Vora

You may also like

  • Funding Alert: We just raised $10M Series A funding and sprinted to 100s of customers in just 7 months

    Funding Alert: We just raised $10M Series A funding and sprinted to 100s of customers in just 7 months

    It gives us immense pleasure to announce that we have raised $10M as part of our Series A funding led by Elevation Capital, participation from Accel and Blume ventures. We started this journey in Mid 2021 with an aim to ensure that SaaS deals should be won based on merit and not financial muscle. We ... Read more


  • SOC 2 Compliance Checklist: The Detailed Guide for 2022

    SOC 2 Compliance Checklist: The Detailed Guide for 2022

    With cloud-hosted applications proliferating, compliance with SOC 2 is fast-growing as a must-have security benchmark for SaaS firms. Therefore, getting a SOC 2 compliance isn’t a question of why as much as when.  So, if SOC 2 is on your mind, here’s a handy SOC 2 compliance checklist to plan and prepare for a successful ... Read more


  • Who Does GDPR Apply To?

    Who Does GDPR Apply To?

    Key Points GDPR is the European Union’s new data privacy law that was formed to give more control to EU citizens and residents over the use of their data. GDPR mainly controls the data processing activities related only to EU citizens’ & residents’ data undertaken by any public or private company worldwide.  There are two ... Read more


  • Sprinto named as Security Compliance Leader in G2 Summer 2022 Report

    Sprinto named as Security Compliance Leader in G2 Summer 2022 Report

    We’re thrilled to announce that Sprinto has been recognized as a Security Compliance Leader in the Summer 2022 Grid® Report by G2.  Sprinto also ranked #1 in Best Usability, Best Relationship and Best Price, outperforming the competition and collectively winning 9 badges across categories. G2 is one of the largest software marketplace and services review ... Read more