Home HIPAA Tools HIPAA Covered Entity Decision Tool

Free HIPAA covered entity
decision tool

Not sure whether HIPAA applies to you? Answer a few questions and this tool tells you whether your organization is likely a HIPAA Covered Entity, a Business Associate, or neither, based on the definitions at 45 CFR §160.103. Download the determination as a Word document or PDF. Everything runs locally in your browser, so no data leaves your device and no sign-up is needed.

Question 1

Which best describes your organization?

How the covered entity decision tool works

Answer a few questions

Tell the tool what your organization does and how it handles health information.

See your determination

Find out whether you are likely a covered entity, a business associate, or neither, with the reasoning.

Download the summary

Export the determination and your answers as a PDF or Word file. Nothing you enter ever leaves your device.

Free, secure, and HIPAA-standard by default

Most compliance quizzes ask for your email before showing a result, or send your answers to their servers. This one is different, and the logic follows the HIPAA definitions at 45 CFR §160.103:

100% in-browser

The determination is made on your device; nothing is uploaded.

No account required

No sign-up, no email wall, no tracking.

Free, real download

The full determination as Word or PDF at no cost, not a teaser.

The three types HIPAA defines

Covered entity: a health plan, a healthcare clearinghouse, or a provider who transmits health information electronically for a standard transaction.
Business associate: a person or entity that handles PHI on behalf of a covered entity or another business associate.
Neither: an organization that does not meet either definition, though other privacy laws may still apply.

Built For Every Healthcare Organization

Knowing your HIPAA status is the first step to compliance. This tool answers the question in a minute, and it pairs with HIPAA-compliant survey software when you collect health data through forms.

Solo & small practices

Get compliant paperwork without a compliance team.

Multi-location groups

Standardize HIPAA documents across every site.

Digital health startups

Set up HIPAA foundations before you scale.

SaaS & tech vendors

Cover the PHI you touch for your healthcare customers.

Billing companies & MSOs

Handle records for the practices you support.

Nonprofits & community clinics

Stay compliant on a tight budget.

Collecting PHI through forms or surveys?

HIPAA-compliant survey software from BlockSurvey signs a BAA with you, so the tool you use to gather health data is covered too.

More free HIPAA tools

Explore more

HIPAA BAA generator

Generate a signable HIPAA Business Associate Agreement as Word or PDF, free and private.

HIPAA Confidentiality / NDA generator

Create a HIPAA confidentiality agreement / NDA for staff and contractors as Word or PDF.

Notice of Privacy Practices generator

Generate a HIPAA-compliant privacy notice explaining how patient health information is used and shared.

Breach Notification Letter generator

Generate the letter organizations send to patients when their protected health information is exposed.

HIPAA Fax Cover Sheet generator

Create a HIPAA-compliant medical fax cover sheet with confidentiality notices.

Attestation / Audit Log generator

Generate HIPAA training attestation forms and audit logs to track access to patient records.

Sign-in Sheet + Records Request generator

Create a privacy-safe patient sign-in sheet and a form for patients to request copies of their records.

HIPAA Risk Assessment Tool

Run a HIPAA security risk assessment across administrative, physical, and technical safeguards and download a report.

HIPAA Consent / Release Form generator

Create a HIPAA authorization for release of health information, signable, as Word or PDF.

HIPAA Compliance Plan / Manual builder

Build a HIPAA policies-and-procedures manual with the safeguards, breach, and patient-rights sections your organization needs.

HIPAA Compliance Cost Estimator

Estimate the ballpark cost to become and stay HIPAA compliant, itemized by size and needs.

HIPAA Compliance Checklist

Work through a HIPAA compliance checklist, track live progress, and download the completed checklist.

HIPAA Incident / Breach Report generator

Document a security incident and run the four-factor breach risk assessment as Word or PDF.

Security & Compliance Policy Templates

A library of ready-to-edit HIPAA security and privacy policy templates you can download as Word or PDF.

HIPAA Compliance Quiz & Training

Take a HIPAA awareness quiz, see your score with explanations, and download a training completion record.

Frequently asked questions

What is a HIPAA covered entity?

A covered entity is one of three things under 45 CFR 160.103: a health plan, a healthcare clearinghouse, or a healthcare provider who transmits any health information electronically in connection with a HIPAA standard transaction, such as an electronic claim or eligibility check. If you are a covered entity, HIPAA's Privacy, Security, and Breach Notification Rules apply to you directly.

What is a business associate?

A business associate is a person or entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or another business associate, to perform a function or service for them (45 CFR 160.103). Examples include cloud storage providers, billing companies, IT vendors, and analytics firms that handle PHI. Business associates must sign a business associate agreement and comply with the Security Rule.

Can an organization be both a covered entity and a business associate?

Yes. An organization can be a covered entity for its own patients or members and a business associate when it handles PHI on behalf of another covered entity. A hospital that also provides billing services to an unaffiliated clinic is a common example. In that case both sets of obligations apply to the relevant activities.

Is a healthcare provider always a covered entity?

No. A provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction. A provider that runs entirely on paper and never sends electronic transactions may not be a covered entity, though this is uncommon today because most billing and eligibility checks are electronic.

Do you store the answers I give?

No. The tool runs entirely in your browser. Your answers and the determination are never sent to or stored on any server, which is why no sign-up is required. If you download the summary, it is generated on your device.

Is this a substitute for legal advice?

No. This tool gives a preliminary determination based on the HIPAA definitions at 45 CFR 160.103, but it is not legal advice and is not guaranteed to be correct for your specific situation. Edge cases, hybrid entities, and state law can change the answer. Confirm your status with qualified counsel or your compliance team before relying on it.