HIPAA, or the Health Insurance Portability and Accountability Act of 1996, applies to both individuals and organizations. Those who must comply with HIPAA are often referred to as HIPAA covered entities.
HIPAA covered entities include health insurance companies, clearinghouses, and certain health care providers:
Health plans
For HIPAA purposes, health plans include:
- Health insurance companies
- HMOs, or health maintenance organizations
- Employer-sponsored health plans
- Government programs that pay for health care, such as Medicare, Medicaid, military and veterans' health care programs
Clearing Centers
Clearinghouses include organizations that process non-standard health information according to content or data format standards or vice versa on behalf of other organizations.
Providers
Providers who submit HIPAA transactions, such as claims, electronically are covered by the law. Such providers include, but are not limited to:
- Doctors
- Clinics
- Psychologists
- Dentists
- Chiropractors
- Nursing homes
- Pharmacies
About business associations
If a covered entity engages a business associate to assist in carrying out its health care operations and functions, the covered entity must have a written business associate agreement or other agreement with such associate that:
- Sets out exactly what the business associate is supposed to do
- Requires the business associate to be HIPAA compliant
Examples of business partners are:
- A third-party administrator who assists the health plan in processing claims
- Consultant performing resource utilization analysis for the hospital
- A medical clearinghouse that translates a claim from a non-standard format to a standard transaction on behalf of the health care provider and forwards the processed transaction to the payer
- Independent medical transcriptionist providing transcription services to the physician
In addition, a covered provider, health plan, or clearinghouse may be a business associate of another covered entity.
Exceptions
An organization may request an exception from the Secretary's use of a standard transaction to test a proposed modification to that standard.