Who Does HIPAA Apply To? Updated 2026 Guide

Understanding who HIPAA applies to requires looking at more than whether an organization handles health information. HIPAA primarily applies to covered entities, certain business associates, and subcontractors that handle protected health information on their behalf. Other organizations may work with health-related data without being directly regulated by HIPAA.

That distinction matters because information is not automatically protected health information, or PHI, simply because it relates to someone’s health. Whether HIPAA applies depends on who holds the information, why it is being handled, and the relationship between the organizations involved.

Which Organizations Are Covered by HIPAA?

The HIPAA Rules directly apply to three main categories of covered entities: health care providers that meet certain requirements, health plans, and health care clearinghouses. Business associates also have direct responsibilities under parts of HIPAA when they handle PHI for covered entities.

Health Care Providers

A health care provider is covered by HIPAA when it furnishes healthcare and transmits health information electronically in connection with certain transactions for which HHS has adopted standards.

This can include physicians, hospitals, clinics, dentists, pharmacies, psychologists, nursing facilities, and other providers.

Not every healthcare provider is automatically a HIPAA covered entity. A provider that does not conduct the required standard electronic transactions may fall outside the covered entity definition.

This is why the type of care being provided is only part of the analysis. The provider’s administrative and electronic transaction practices also matter.

Health Plans

Health plans are another major category of covered entity.

Examples can include health insurance companies, HMOs, Medicare, Medicaid, employer-sponsored group health plans, and certain other programs that provide or pay for healthcare.

There are exceptions. A group health plan with fewer than 50 participants that is administered solely by the employer that established it is not a covered health plan. Workers’ compensation, automobile, and property and casualty insurers are also not health plans under HIPAA.

An employer itself is not automatically a HIPAA covered entity simply because it sponsors a health plan. The group health plan is the covered entity, and HIPAA places restrictions on when PHI from that plan can be shared with the employer acting as plan sponsor.

Health Care Clearinghouses

Health care clearinghouses process nonstandard health information they receive from another organization into a standard format or standard data content, or convert standard transactions back into nonstandard form, for certain healthcare transactions.

For example, a clearinghouse may convert billing information into a format that can be processed by a health plan.

These organizations are directly covered by HIPAA because of the role they play in standardized healthcare transactions.

Understanding these categories is a starting point for determining broader HIPAA compliance requirements, because organizations that work with covered entities may also become subject to parts of HIPAA through their business relationships.

What is a Hybrid Entity?

Some organizations perform both HIPAA-covered and non-covered functions, such as a university that operates a medical clinic or a county government that runs a health department. 

These organizations can designate themselves as hybrid entities, so that HIPAA applies only to the designated health care components rather than the entire organization. The organization must document that designation and keep appropriate separation between covered and non-covered components.

When Does HIPAA Apply to Business Associates?

HIPAA applies to a business associate when that person or organization performs certain functions or services for a covered entity and creates, receives, maintains, or transmits PHI in connection with that work.

Business associates are not merely contractually responsible to covered entities. HHS states that they are directly liable for compliance with certain HIPAA requirements.

What Makes a Company a HIPAA Business Associate?

The key question is what the company does on behalf of the covered entity and whether that work involves PHI.

A vendor may qualify as a business associate when it provides services such as claims processing, data analysis, billing, legal services, accounting, IT support, cloud hosting, or other activities that involve access to PHI.

A company’s industry label is not what determines its status. A technology company, consultant, or cloud provider may or may not be a business associate depending on its relationship with the covered entity and whether it handles PHI on the covered entity’s behalf.

Common Examples of Business Associates

Common business associates can include cloud service providers, medical billing companies, managed IT providers, consultants, attorneys, accountants, data processing companies, and record storage services.

HHS also identifies certain health app developers as business associates when they provide an app on behalf of a covered entity and create, receive, maintain, or transmit patient PHI as part of that service.

The same type of vendor may fall outside HIPAA in another arrangement, which is why each relationship needs to be reviewed individually.

When Is a Vendor Not a Business Associate?

A vendor is not automatically a business associate simply because it sells products or services to a covered entity.

For example, HHS explains that a software vendor does not become a business associate merely by selling software when it does not have access to the covered entity’s PHI. If the same vendor hosts patient information or accesses PHI while providing support, however, it may become a business associate.

Some relationships do not create business associate status. Examples include disclosures to another health care provider for treatment, members of the covered entity’s own workforce, and “conduits,” such as the U.S. Postal Service or internet service providers, that only transmit PHI and do not store it or access it beyond occasional, random exposure.

Does HIPAA Apply to Subcontractors?

HIPAA can extend beyond a covered entity’s direct vendors.

A subcontractor may become a business associate when it handles PHI on behalf of another business associate.

When Does a Business Associate Subcontractor Fall Under HIPAA?

A subcontractor generally falls within the business associate definition when it creates, receives, maintains, or transmits PHI on behalf of a business associate.

For example, if a billing company is a business associate and hires a cloud provider to store PHI, that cloud provider may be the billing company’s business associate subcontractor.

The obligation can continue through multiple levels of subcontractors when PHI continues to be handled on behalf of the upstream business associate.

When Is a Business Associate Agreement Required?

Covered entities must have a written business associate agreement, or BAA, with each of their business associates before PHI is shared..

Business associates must also have a written BAA with any subcontractors that creates, receives, maintains, or transmits PHI on their behalf. HHS states that these arrangements must meet the same basic requirements that apply to BAAs between covered entities and business associates.

A signed agreement should not be the end of vendor oversight. Regular vendor security assessments can help organizations understand how third parties protect sensitive information and whether changes in services introduce new risks.

Does HIPAA Apply to Employers?

HIPAA generally does not regulate employers in their role as employers.

This is an area where confusion is common because employers may collect medical information for leave, benefits, workplace accommodations, or other employment purposes.

When HIPAA Generally Does Not Apply to Employers

The HIPAA Privacy Rule generally does not apply to information an employer maintains as part of employment records.

For example, information provided for sick leave, workplace accommodations, workers’ compensation, or other employment purposes may contain medical details without becoming PHI under HIPAA.

Other laws may still protect that information, but HIPAA is generally not the law governing the employer’s use of it.

When an Employer’s Group Health Plan Is Subject to HIPAA

An employer-sponsored group health plan may itself be a HIPAA covered entity.

When an employer acts as the plan sponsor, HIPAA limits when the group health plan or its insurer may provide PHI to the employer.

Similar distinctions apply to workplace wellness programs. HHS explains that a wellness program offered through a group health plan may involve PHI protected by HIPAA, while a program offered directly by an employer outside the plan generally is not covered by HIPAA.

Are Employee Medical and Employment Records Covered by HIPAA?

Employment records held by an employer are generally not PHI under HIPAA, even when they contain health information.

The situation is different when the same individual receives healthcare from a covered provider or participates in a covered health plan. Medical records held by the provider or health plan can still be protected by HIPAA even though employment records held by the employer are not.

Does HIPAA Apply to Researchers?

HIPAA can affect research involving PHI, but researchers are not automatically covered entities or business associates simply because they conduct health research.

The answer depends on the researcher’s role and where the information comes from.

When Research Involving PHI Is Subject to HIPAA Requirements

If a covered entity uses or discloses PHI for research, the HIPAA Privacy Rule governs that use or disclosure.

In many situations, the research participant provides an authorization. HIPAA also allows certain research uses or disclosures without individual authorization when specific requirements are met, such as an approved waiver from an Institutional Review Board or Privacy Board.

Are Researchers Automatically Covered Entities or Business Associates?

No.

A researcher becomes a covered healthcare provider only when the researcher furnishes healthcare and conducts the qualifying electronic transactions that make a healthcare provider subject to HIPAA.

A researcher also does not automatically become a business associate merely because a covered entity discloses PHI to the researcher for research. HHS specifically states that a business associate agreement is not required solely because PHI is disclosed for a permitted research purpose.

When Can PHI Be Used or Disclosed for Research?

A covered entity may use or disclose PHI for research with a valid individual authorization.

In certain circumstances, PHI may also be used without authorization, including when an IRB or Privacy Board has approved a waiver, for certain activities preparatory to research, for certain research involving decedents, or when a limited data set is used under an appropriate data use agreement.

The research rules are specific, so organizations should confirm which pathway applies before PHI is disclosed.

Who Does HIPAA Generally Not Apply To?

Many organizations collect health-related information without meeting the legal definition of a covered entity or business associate.

HHS states that an organization that is neither a covered entity nor a business associate generally does not have to comply with the HIPAA Rules.

Life Insurance Companies and Most Employers

Life insurance companies and employers acting in their normal employment capacity generally are not HIPAA covered entities.

HHS specifically identifies employers and life insurers among organizations outside the core HIPAA covered entity categories.

Other privacy, employment, insurance, or state laws can still apply.

Schools and Educational Records

Student health information maintained by a school can fall under the Family Educational Rights and Privacy Act, or FERPA, instead of HIPAA.

For example, health records maintained by a school nurse acting for a FERPA-covered school are generally education records under FERPA and are excluded from HIPAA.

An outside healthcare provider that is not acting on behalf of the school may be treated differently. HIPAA can apply to that provider’s records if the provider separately meets the definition of a covered entity.

Consumer Health and Fitness Apps That Are Not Covered Entities or Business Associates

A consumer health app is not automatically covered by HIPAA simply because it stores health information.

If an individual independently chooses an app that is not provided by or acting on behalf of a covered entity, HIPAA generally does not apply to the information once the app receives it.

An app provided by or on behalf of a covered entity may be different because the developer may qualify as a business associate.

Apps outside HIPAA may still be subject to the FTC Act, the FTC Health Breach Notification Rule, or other privacy laws.

Other Organizations That Do Not Meet the HIPAA Covered Entity or Business Associate Definitions

Many organizations can handle health-related information without falling under HIPAA.

The important question is not simply whether health information exists. The organization must meet the definition of a covered entity or handle PHI on behalf of a covered entity or another business associate in a relationship that creates business associate status.

How Can You Tell Whether HIPAA Applies to Your Organization?

Determining HIPAA applicability usually requires looking at the organization’s role, activities, transactions, and relationships. Once HIPAA applies, a structured risk assessment can help identify risks to the PHI and ePHI the organization creates, receives, maintains, or transmits.

Do You Qualify as a Covered Entity?

First, determine whether the organization is a health plan, health care clearinghouse, or healthcare provider that conducts qualifying electronic transactions.

If not, move to the business associate analysis.

Do You Create, Receive, Maintain, or Transmit PHI for a Covered Entity?

If your organization handles PHI to perform services or functions for a covered entity, it may be a business associate.

Look at the actual service arrangement rather than relying only on how the contract describes the company.

Are You a Subcontractor Handling PHI for a Business Associate?

A subcontractor may have direct HIPAA responsibilities even when it has no contract with the original covered entity.

If PHI is being handled on behalf of a business associate, review whether subcontractor business associate requirements apply.

Are You Handling Health Information Outside a HIPAA-Covered Relationship?

Health information handled directly by an employer, consumer app, school, researcher, or other organization may fall outside HIPAA depending on the circumstances.

That does not mean the information is unregulated. Other federal and state privacy requirements may still apply.

Has Who HIPAA Applies to Changed in 2026?

HIPAA cybersecurity requirements continue to receive regulatory attention, but the basic categories used to determine who is covered remain important.

Do the Core Covered Entity Categories Remain the Same?

Yes. As of 2026, the core covered entity categories remain health plans, health care clearinghouses, and qualifying healthcare providers.

The proposed HIPAA Security Rule changes focus primarily on strengthening cybersecurity and security-management requirements rather than replacing these basic covered entity categories.

Do Business Associates and Subcontractors Still Have Direct HIPAA Responsibilities?

Yes.

Business associates continue to have direct responsibilities under certain provisions of the HIPAA Rules, and subcontractors that handle PHI on behalf of business associates can also be subject to HIPAA.

Organizations should therefore review vendor and subcontractor relationships whenever data access or services change, rather than assuming that HIPAA stops with the covered entity. Clear policy development can also help document how PHI is handled, who is responsible for specific compliance activities, and how those requirements apply across internal teams and third parties.

How Nexeris Helps Organizations Determine Their HIPAA Responsibilities

Determining whether HIPAA applies can become complicated when an organization serves healthcare customers, uses multiple vendors, handles different types of health information, or performs several roles within the same business.

Nexeris helps organizations review how PHI is created, received, maintained, and transmitted, identify covered entity and business associate relationships, examine vendor arrangements, and understand which compliance activities need to be addressed. Ongoing GRC support can also help teams manage those responsibilities as systems, vendors, and business processes change.

Working with a HIPAA compliance consultant can also help teams move from determining applicability to identifying security, documentation, risk management, and vendor requirements that apply to their specific environment.

FAQs

Who Does HIPAA Apply To?

HIPAA primarily applies to covered entities, including qualifying healthcare providers, health plans, and health care clearinghouses. Certain requirements also apply directly to business associates and subcontractors that handle PHI on behalf of covered entities or other business associates.

Does HIPAA Apply to All Healthcare Providers?

No. A healthcare provider generally becomes a HIPAA-covered entity when it conducts certain standard healthcare transactions electronically or has a billing service or other third party conduct them on its behalf.

A provider is not automatically covered simply because it provides healthcare.

Does HIPAA Apply to Business Associates?

Yes. Business associates that create, receive, maintain, or transmit PHI on behalf of a covered entity have direct responsibilities under certain HIPAA requirements.

Does HIPAA Apply to Subcontractors?

It can. A subcontractor that handles PHI on behalf of a business associate can itself qualify as a business associate and become subject to applicable HIPAA requirements.

Does HIPAA Apply to Employers?

HIPAA generally does not apply to employers in their role as employers. However, an employer-sponsored group health plan can be a HIPAA covered entity, and HIPAA restricts how PHI from the plan may be shared with the employer.

Does HIPAA Apply to Employee Medical Records?

Employment records maintained by an employer are generally not protected by HIPAA, even when they include health information. Medical records maintained by a covered healthcare provider or health plan may still be protected.

Does HIPAA Apply to Researchers?

Researchers are not automatically subject to HIPAA. HIPAA can apply when researchers are themselves covered entities or when covered entities use or disclose PHI for research. Research disclosures must follow the applicable Privacy Rule requirements.

Does HIPAA Apply to Health and Fitness Apps?

Not automatically. A health or fitness app may fall outside HIPAA when it operates independently of covered entities and business associates. If the app handles PHI on behalf of a covered entity, however, the developer may qualify as a business associate and become subject to HIPAA requirements.