What is a HIPAA covered entity?

A covered entity is one of three things under 45 CFR 160.103: a health plan, a healthcare clearinghouse, or a healthcare provider who transmits any health information electronically in connection with a HIPAA standard transaction, such as an electronic claim or eligibility check. If you are a covered entity, HIPAA's Privacy, Security, and Breach Notification Rules apply to you directly.

What is a business associate?

A business associate is a person or entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or another business associate, to perform a function or service for them (45 CFR 160.103). Examples include cloud storage providers, billing companies, IT vendors, and analytics firms that handle PHI. Business associates must sign a business associate agreement and comply with the Security Rule.

Can an organization be both a covered entity and a business associate?

Yes. An organization can be a covered entity for its own patients or members and a business associate when it handles PHI on behalf of another covered entity. A hospital that also provides billing services to an unaffiliated clinic is a common example. In that case both sets of obligations apply to the relevant activities.

Is a healthcare provider always a covered entity?

No. A provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction. A provider that runs entirely on paper and never sends electronic transactions may not be a covered entity, though this is uncommon today because most billing and eligibility checks are electronic.

Do you store the answers I give?

No. The tool runs entirely in your browser. Your answers and the determination are never sent to or stored on any server, which is why no sign-up is required. If you download the summary, it is generated on your device.

Is this a substitute for legal advice?

No. This tool gives a preliminary determination based on the HIPAA definitions at 45 CFR 160.103, but it is not legal advice and is not guaranteed to be correct for your specific situation. Edge cases, hybrid entities, and state law can change the answer. Confirm your status with qualified counsel or your compliance team before relying on it.

Free HIPAA covered entity decision tool

Not sure whether HIPAA applies to you? Answer a few questions and this tool tells you whether your organization is likely a HIPAA Covered Entity, a Business Associate, or neither, based on the definitions at 45 CFR §160.103. Download the determination as a Word document or PDF. Everything runs locally in your browser, so no data leaves your device and no sign-up is needed.

Question 1

Which best describes your organization?

How the covered entity decision tool works

01
Answer a few questions
Tell the tool what your organization does and how it handles health information.
02
See your determination
Find out whether you are likely a covered entity, a business associate, or neither, with the reasoning.
03
Download the summary
Export the determination and your answers as a PDF or Word file. Nothing you enter ever leaves your device.

Free, secure, and HIPAA-standard by default

Most compliance quizzes ask for your email before showing a result, or send your answers to their servers. This one is different, and the logic follows the HIPAA definitions at 45 CFR §160.103:

01
100% in-browser
The determination is made on your device; nothing is uploaded.
02
No account required
No sign-up, no email wall, no tracking.
03
Free, real download
The full determination as Word or PDF at no cost, not a teaser.

The three types HIPAA defines

Covered entity: a health plan, a healthcare clearinghouse, or a provider who transmits health information electronically for a standard transaction.
Business associate: a person or entity that handles PHI on behalf of a covered entity or another business associate.
Neither: an organization that does not meet either definition, though other privacy laws may still apply.

Built For Every Healthcare Organization

Knowing your HIPAA status is the first step to compliance. This tool answers the question in a minute, and it pairs with HIPAA-compliant survey software when you collect health data through forms.

01
Solo & small practices
Get compliant paperwork without a compliance team.
02
Multi-location groups
Standardize HIPAA documents across every site.
03
Digital health startups
Set up HIPAA foundations before you scale.
04
SaaS & tech vendors
Cover the PHI you touch for your healthcare customers.
05
Billing companies & MSOs
Handle records for the practices you support.
06
Nonprofits & community clinics
Stay compliant on a tight budget.

Collecting PHI through forms or surveys?

HIPAA-compliant survey software from BlockSurvey signs a BAA with you, so the tool you use to gather health data is covered too.

More free HIPAA tools

Explore more →

HIPAA BAA generatorGenerate a signable HIPAA Business Associate Agreement as Word or PDF, free and private.

HIPAA Confidentiality / NDA generatorCreate a HIPAA confidentiality agreement / NDA for staff and contractors as Word or PDF.

Notice of Privacy Practices generatorGenerate a HIPAA-compliant privacy notice explaining how patient health information is used and shared.

These tools help you document compliance. When you need to collect PHI itself, you need a BAA and encryption in the product: HIPAA-compliant survey software.

Frequently Asked Questions

: A covered entity is one of three things under 45 CFR 160.103: a health plan, a healthcare clearinghouse, or a healthcare provider who transmits any health information electronically in connection with a HIPAA standard transaction, such as an electronic claim or eligibility check. If you are a covered entity, HIPAA's Privacy, Security, and Breach Notification Rules apply to you directly.
: A business associate is a person or entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or another business associate, to perform a function or service for them (45 CFR 160.103). Examples include cloud storage providers, billing companies, IT vendors, and analytics firms that handle PHI. Business associates must sign a business associate agreement and comply with the Security Rule.
: Yes. An organization can be a covered entity for its own patients or members and a business associate when it handles PHI on behalf of another covered entity. A hospital that also provides billing services to an unaffiliated clinic is a common example. In that case both sets of obligations apply to the relevant activities.
: No. A provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction. A provider that runs entirely on paper and never sends electronic transactions may not be a covered entity, though this is uncommon today because most billing and eligibility checks are electronic.
: No. The tool runs entirely in your browser. Your answers and the determination are never sent to or stored on any server, which is why no sign-up is required. If you download the summary, it is generated on your device.
: No. This tool gives a preliminary determination based on the HIPAA definitions at 45 CFR 160.103, but it is not legal advice and is not guaranteed to be correct for your specific situation. Edge cases, hybrid entities, and state law can change the answer. Confirm your status with qualified counsel or your compliance team before relying on it.

Which best describes your organization?

How the covered entity decision tool works

Answer a few questions

See your determination

Download the summary

Free, secure, and HIPAA-standard by default

100% in-browser

No account required

Free, real download

The three types HIPAA defines

Built For Every Healthcare Organization

Solo & small practices

Multi-location groups

Digital health startups

SaaS & tech vendors

Billing companies & MSOs

Nonprofits & community clinics

Collecting PHI through forms or surveys?

More free HIPAA tools

Frequently Asked Questions