45 CFR § 160.103
Definitions
The definitions section. It decides whether HIPAA applies to you at all.
Read the full official text on eCFRResearched and written by Larry Osakwe · Last verified August 4, 2026
Checked against 45 CFR 160.103 via eCFR. Not a lawyer, not a certified compliance professional, and not affiliated with HHS.
What 160.103 actually says
45 CFR 160.103 is where HIPAA defines its own vocabulary, and it is the section that settles the only question that matters first: whether you are a covered entity. A health care provider becomes one by transmitting health information electronically in connection with a covered transaction. Not by treating patients, not by holding records, and not by your credential.
Two exclusions inside this section do more work than most summaries admit. The definition of health plan excludes excepted benefits, which is why an electronic claim to an auto or workers' compensation carrier does not make you covered. And the definition of protected health information excludes FERPA education records, which is why a school-based clinician is usually outside HIPAA entirely.
The paragraphs above are our plain-English reading. The blocks below are quoted verbatim from the regulation.
The text that matters
Health plan excludes: (i) Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1)
Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years.
Quoted from 45 CFR § 160.103. US federal regulations are not subject to copyright. Retrieved from eCFR and last checked August 4, 2026.
What this section means you must hold
The regulation states obligations. This is the paperwork those obligations translate into, which is the part the regulation itself leaves you to work out.
| The obligation | What you produce for it |
|---|---|
| Reach a documented conclusion about whether you are a covered entity, and revisit it when your billing changes | A dated written determination. Nothing in the rule demands one, but it is the first thing worth having, because every other obligation depends on the answer. |
| Identify which of your vendors are business associates, since the term is defined here | A vendor register, with a signed BAA per entry |
Where practices get 160.103 wrong
Assuming the credential decides it. A cash-only massage therapist and an insurance-billing one hold identical records and sit on opposite sides of this definition. The trigger is the electronic covered transaction, and it is tripped just as effectively by software filing an eligibility check on your behalf as by you filing a claim yourself.
Other sections people look up
45 CFR § 164.504(e)
Uses and disclosures: Organizational requirements
45 CFR § 164.520
Notice of privacy practices for protected health information
45 CFR § 164.308
Administrative safeguards
45 CFR § 164.508
Uses and disclosures for which an authorization is required
Educational summaries of federal regulations, not legal advice and not a determination about any specific practice. Where our reading and the regulation differ, the regulation controls; the eCFR link above is authoritative.
Get every document, done for you
Preview the binder free. Your binder is built to order and delivered within 30 days, with a full refund anytime before then.
See the binder and pricing