Which statement accurately describes a Covered Entity?

• A. An entity that transmits health information electronically in connection with a HIPAA-covered transaction
• B. A patient
• C. A vendor that prints records
• D. A facility that uses only paper records

Answer: (A)

Under HIPAA, a Covered Entity is an organization that handles protected health information in the standard electronic transactions defined by HIPAA. This includes health plans, healthcare providers who electronically transmit PHI in connection with a HIPAA transaction, and healthcare clearinghouses. The statement describes an entity that transmits health information electronically in connection with a HIPAA-covered transaction, which exactly fits the definition of a covered entity. A patient is not a covered entity because the term refers to the organization that uses and transmits the PHI, not the individual who is the subject of the PHI. A vendor that prints records would typically be a business associate, not a covered entity, since it acts on behalf of a covered entity. A facility that uses only paper records isn’t transmitting PHI electronically, so it wouldn’t meet the electronic-transaction criterion to be a covered entity.