What Is a HIPAA Covered Entity? The 3 Types, Explained

A HIPAA covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction, such as an insurance claim, under 45 CFR 160.103 (eCFR). Covered entities must follow the HIPAA Privacy, Security and Breach Notification Rules (HHS) and get a BAA from each vendor that handles their PHI as a business associate. Curve Compliance signs one on every plan.

Book a call. If you are a covered provider that runs ads, your website tracking is part of your HIPAA picture, and Meta and Google Ads do not sign a BAA. Curve Compliance sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

The three types of covered entities

HHS puts it simply: "The HIPAA Rules apply to covered entities and business associates," and "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS). The three types are defined in 160.103 (eCFR):

Type	The legal test	Examples
Health plan	An individual or group plan that provides or pays for medical care (160.103)	Health insurance companies, HMOs, company health plans, and government programs that pay for health care, such as Medicare, Medicaid, and military and veterans programs (HHS)
Health care clearinghouse	Processes health information from a nonstandard format into a standard transaction for another entity, or the reverse (160.103)	Billing services, community health information systems, and "value-added" networks and switches that perform those functions (160.103)
Health care provider	Furnishes, bills or is paid for health care in the normal course of business, and "transmits any health information in electronic form in connection with a transaction covered by this subchapter" (160.103)	Doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (HHS)

The health plan definition also names Medicare Parts A and B, Medicaid, Medicare Advantage, Part D, the veterans and Indian Health Service programs, and the Federal Employees Health Benefits Program, among others (160.103).

The provider test: electronic standard transactions

Being a provider is not enough; the provider must send at least one standard transaction electronically. CMS's Covered Entity Decision Tool boils it down to two questions: "Does the person, business, or agency furnish, bill, or receive payment for health care in the normal course of business?" and "Does the person, business, or agency transmit (send) any covered transactions electronically?" Two yeses make it a covered entity (CMS).

CMS says "Covered transactions are transactions for which the Secretary has adopted standards; the standards are at 45 C.F.R. Part 162" (CMS). They are claims or encounter information, eligibility inquiries, referral certification and authorization, claim status, enrollment and disenrollment, payment and remittance advice, premium payments, and coordination of benefits (CMS). A final rule published March 24, 2026 adopted standards for health care claims attachments transactions too, effective May 26, 2026, and "Compliance with these regulations is required by May 26, 2028" (91 FR 14350; 45 CFR 162.2002). HHS adds three points (HHS):

• Size does not matter. "Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity" (HHS).
• Email is not the test. "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction" (HHS).
• A billing service counts. The rule covers a provider "whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf" (HHS).

For two common edge cases, see does HIPAA apply to med spas and does HIPAA apply to cash-pay telehealth.

Who is not a covered entity

• Providers that never send a standard transaction electronically. CMS's tool says a provider that answers no to the second question "is NOT a covered health care provider and therefore not a covered entity" (CMS).
• Small self-administered employer plans. HHS says "a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity" (HHS).
• Some government programs. Programs whose principal purpose is not providing or paying for health care, such as food stamps, are not health plans, and neither are programs whose main activity is providing care directly, such as a community health center (HHS). Providers in those programs still face the provider test.
• Some insurers. "Certain types of insurance entities are also not health plans, including entities providing only workers' compensation, automobile insurance, and property and casualty insurance" (HHS).

Outside HIPAA does not mean unregulated. The FTC's Health Breach Notification Rule applies to "vendors of personal health records, PHR related entities, and third party service providers," and "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity" (16 CFR 318.1). See who the FTC rule covers beyond HIPAA.

Hybrid entities

A hybrid entity is a single legal entity that is a covered entity, "Whose business activities include both covered and non-covered functions," and that designates its health care components (164.103). HHS explains that the entity "must designate in writing its operations that perform covered functions," after which most Privacy Rule requirements apply only to those components. "A covered entity that does not make this designation is subject in its entirety to the Privacy Rule" (HHS). The rules for components sit in 164.105.

Covered entity vs business associate

A business associate is a person or company that handles PHI on a covered entity's behalf, such as a billing company, cloud host or tracking vendor. The two roles can overlap: under 160.103, "A covered entity may be a business associate of another covered entity" (eCFR), and HHS notes that clearinghouses usually receive health information "as a business associate" of the plan or provider they serve (HHS). See what a business associate is for the full test, what a BAA is for the contract, and the BAA template guide to draft or review one.

What covered entities must do

• Designate a privacy official and a contact. "A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity," plus a contact person or office for complaints (164.530(a)).
• Designate a security official. The Security Rule requires you to "Identify the security official who is responsible for the development and implementation of the policies and procedures" it requires (164.308(a)(2)).
• Write policies and train staff. A covered entity "must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule," and train its workforce on them (HHS).
• Give patients a notice. "Each covered entity, with certain exceptions, must provide a notice of its privacy practices" (HHS). See notice of privacy practices.
• Sign BAAs. Get a written BAA from each business associate before it handles PHI (HHS).
• Watch website tracking. HHS says "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking vendors (HHS).

Breach notification is its own rule; see the HIPAA Breach Notification Rule. Whether your organization is a covered entity, a hybrid entity or neither turns on facts, so talk to your counsel.

How Curve Compliance helps

For a covered provider, the website is part of HIPAA compliance, and the ad platforms it reports to do not sign a BAA: the BAA Directory lists Meta and Google Ads as not signing one. Curve Compliance acts as your business associate for ad tracking and signs a BAA on every plan, before live tracking begins (BAA Directory entry).

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 160.103; 45 CFR 160.102; 45 CFR 160.203; 45 CFR 164.103; 45 CFR 164.105; 45 CFR 164.308; 45 CFR 164.530; 16 CFR 318.1; HHS, Covered Entities and Business Associates; HHS, Summary of the HIPAA Privacy Rule; HHS, Business Associates FAQs; HHS, Use of Online Tracking Technologies; CMS, Are You a Covered Entity?; CMS Covered Entity Decision Tool; 91 FR 14350; 45 CFR 162.2002.

Frequently Asked Questions

What are the three covered entities that must comply with HIPAA?

Health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a standard transaction such as a claim (45 CFR 160.103). Their business associates must also comply with parts of the HIPAA Rules (160.102).

Who qualifies as a covered entity under HIPAA?

Any health plan, any clearinghouse, and any provider that furnishes, bills or is paid for health care and sends at least one standard transaction, such as a claim or eligibility check, electronically, directly or through a billing service (160.103; HHS). CMS's Covered Entity Decision Tool walks through it.

What is not an example of a covered entity under HIPAA?

A provider that never sends a standard transaction electronically, a group health plan with fewer than 50 participants run solely by the employer, and an insurer offering only auto or workers' compensation coverage are not covered entities (HHS). A marketing agency is not one of the three types either, though it can be a business associate (160.103).

What must a covered entity do?

Designate a privacy official and a security official, write privacy policies and train staff, give patients a notice of privacy practices, safeguard PHI, and sign a BAA with each business associate (164.530; 164.308; HHS).

Are insurance companies HIPAA covered entities?

Yes. HHS lists health insurance companies and HMOs as health plans, which are covered entities, but entities providing only workers' compensation, automobile, or property and casualty insurance are not health plans (HHS; HHS summary).

What entities are exempt from HIPAA and not considered to be covered?

Organizations that fit none of the three types: HHS says "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS). Examples include government programs whose main purpose is not health care, such as food stamps, and insurers offering only auto or workers' compensation coverage (HHS).

Who is exempt from HIPAA?

Providers that do not send standard transactions electronically, such as some cash-only practices, are not covered entities (CMS), and a business that is neither a covered entity nor a business associate does not have to comply with the HIPAA Rules (HHS). Some of them fall under the FTC's Health Breach Notification Rule instead (16 CFR 318.1).

Where do HIPAA laws apply?

HIPAA is a federal law, and its rules apply to covered entities and business associates (HHS). A State privacy law that is "more stringent" than the Privacy Rule still applies alongside it (45 CFR 160.203); see does HIPAA preempt state law.

Talk to Curve Compliance

Book a call. If you are a covered entity that runs ads, Curve Compliance keeps your tracking under a BAA it signs on every plan, sends conversions server-side and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.