Covered entities extend beyond healthcare, as non-healthcare industries are entrusted with sensitive personal information. These entities must implement robust security measures, transparent data practices, and proactive compliance efforts by HIPAA regulations.
In the context of privacy regulations like the Health Insurance Portability and Accountability Act (HIPAA), a covered entity is defined as:
"(1) health plans
(2) health care clearinghouses
(3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards."
While the term is typically associated with healthcare organizations due to regulations like HIPAA, the scope of covered entities the term "covered entity" can refer to any organization that deals with sensitive personal information and is subject to specific data protection regulations.
More specifically, it extends to financial institutions, insurance companies, educational institutions, government agencies, and technology companies that handle sensitive personal information.
Go deeper: What is a covered entity?
1. Financial institutions: Banks, credit unions, investment firms, and other financial institutions handle sensitive personal and financial information. The Gramm-Leach-Bliley Act (GLBA) mandates that these entities protect customers' non-public personal information, like their sensitive health information, making them covered entities under GLBA regulations.
2. Insurance companies: The insurance sector, much like healthcare, deals extensively with personal data, including health information, in the case of health insurance providers. So, insurance companies are considered covered entities, which need robust data protection measures to handle PHI.
3. Educational institutions: Schools, colleges, and universities collect a vast array of student data, ranging from academic records to health information and contact details.
In many jurisdictions, educational institutions are recognized as covered entities subject to specific data protection laws, such as the Family Educational Rights and Privacy Act (FERPA).
4. Government agencies: Depending on the jurisdiction, government agencies may be classified as covered entities and are held to stringent data protection standards to safeguard citizens' privacy rights.
More specifically, the HHS states that covered entities include "Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans' health care programs."
5. Technology companies: The HHS offers Guidance on HIPAA & cloud computing; specifically, this guidance assists such entities, including cloud services providers (CSPs), in understanding their HIPAA obligations. It explains, "When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA."
When a covered entity (such as a healthcare provider) hires a cloud service provider (CSP) to handle electronic protected health information (ePHI) on its behalf, the CSP becomes a business associate under HIPAA. The CSP is now subject to HIPAA regulations and must comply with specific requirements regarding the protection and handling of ePHI.
It then states, "Further, when a business associate subcontracts with a CSP to create, receive, maintain, or transmit ePHI on its behalf, the CSP subcontractor itself is a business associate."
If a business associate (such as a billing company or IT vendor) working with a covered entity decides to subcontract some of its services to a CSP. In this case, the CSP subcontractor (the CSP hired by the business associate) also becomes a business associate under HIPAA. So, even though the covered entity does not directly contract the CSP, it is still subject to HIPAA regulations because it handles ePHI on behalf of a business associate, which handles ePHI on behalf of the covered entity.
Go deeper: How to prepare for a HIPAA audit
A covered entity, as defined by HIPAA, is any healthcare provider, health plan, or healthcare clearinghouse that transmits any health information in electronic form.
A business associate is any person or entity that performs certain functions or activities on behalf of or provides certain services to a covered entity that involves the use or disclosure of protected health information (PHI).
Yes, Paubox can assist covered entities and their business associates with HIPAA compliance efforts by providing HIPAA compliant email and text messaging encryption and security solutions.