In the context of the HIPAA definitions, what is a Covered Entity?

• A. An entity that transmits health information electronically in connection with a HIPAA-covered transaction
• B. A patient
• C. A vendor
• D. A government agency

Answer: (A)

HIPAA’s concept of a covered entity hinges on who actually handles and transmits health information in electronic form as part of standard HIPAA transactions. A covered entity is an organization that transmits health information electronically in connection with a HIPAA-covered transaction. This includes healthcare providers that submit PHI electronically, health plans, and healthcare clearinghouses. So the statement describing an entity that transmits health information electronically in connection with a HIPAA-covered transaction matches the definition.

A patient isn’t a covered entity, though patients have rights to their PHI. A vendor is typically a business associate—someone who handles PHI on behalf of a covered entity under contract, not a covered entity itself. A government agency isn’t automatically a covered entity unless it functions as one of the three categories (provider, plan, or clearinghouse) and transmits PHI electronically in a covered transaction.