Glossary

Covered entity

A covered entity is an organization HIPAA regulates directly: healthcare providers who transmit standard electronic transactions, health plans, and healthcare clearinghouses. Vendors that handle protected health information for covered entities are business associates — regulated through contracts and the Security Rule, which is where most health-tech startups actually sit.

Assemble Your GRC Team

Last updated July 26, 2026

The three categories

HIPAA names exactly three kinds of covered entity: providers (hospitals, clinics, physicians, pharmacies) that transmit the standard electronic healthcare transactions, health plans (insurers, HMOs, employer group plans), and clearinghouses that translate health data between formats. The definition is functional, not aspirational — an organization either fits a category or it doesn’t, and “we work in healthcare” doesn’t make you one.

Most startups are business associates

If you sell software or services to providers or plans and touch PHI along the way, you’re a business associate: bound primarily through the business associate agreements you sign, and directly accountable under HIPAA’s Security Rule. Your subcontractors who touch the same data become business associates too, one BAA further down the chain. The label matters practically — it tells you which obligations are yours by law, which arrive by contract, and what your healthcare customers will expect you to evidence.

Why the distinction shapes your program

Covered entities carry the full weight of the Privacy Rule — patient rights, notices, disclosure accounting — while business associates mostly inherit narrower, contract-shaped duties plus the Security Rule’s safeguard requirements. Build to the role you actually occupy: a business associate’s program centers on securing ePHI, honoring BAA terms, and proving both. What that looks like on a startup stack is the subject of HIPAA for startups.

Keep exploring

HIPAA for Startups

Compliance built for the business-associate role.

HIPAA Framework

Privacy Rule, Security Rule, and who they bind.

BAA

How obligations reach you when you’re not a covered entity.

HIPAA scoped to the role you play

Agency builds business-associate programs that hold up to healthcare procurement — safeguards, evidence, and BAA obligations tracked. Rated 4.9 out of 5 stars on G2. 1,000+ companies served since 2021.

Assemble Your GRC Team