Covered Entity
A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction (45 CFR 160.103). For a private practice the trigger is the electronic transaction, most often an insurance claim, not the act of seeing patients.
Last verified: July 23, 2026
What covered entity means under HIPAA
The definition in 45 CFR 160.103 lists three kinds of covered entity. Almost every private practice that asks the question is in the third bucket: a health care provider who transmits health information electronically in connection with a covered transaction. The subtle part is that being a provider is not enough on its own. What makes you a covered entity is the electronic transaction, most commonly submitting an insurance claim, checking eligibility, or receiving electronic remittance, whether you do it yourself or a billing service does it for you.
That is why a genuinely cash-only practice that never electronically transmits a covered transaction can fall outside HIPAA’s transaction rules, while an otherwise identical practice that files one electronic claim is covered. It is also why the answer is profession-specific: dentists and podiatrists are almost always covered, while massage therapists and cash-pay nutritionists frequently are not. State confidentiality law can still apply either way.
Covered-entity status is not a determination this page can make for your practice. The safest step is to work through the electronic-transaction test for your actual billing setup, document the conclusion in writing, and, where it is close, run the HHS/CMS covered-entity decision tool or ask a qualified attorney.
Covered Entity FAQ
Related terms
See every term in the HIPAA glossary.
Turn the vocabulary into the documents
Knowing the terms is step one. See the full document set a covered practice keeps, or generate the ones you can build yourself now.
See what goes in a HIPAA binderSource
Last verified July 23, 2026. This definition is educational self-help information, not legal advice, and it paraphrases the regulation; the controlling text is 45 CFR § 160.103, linked above. Whether HIPAA applies to your practice depends on the covered-entity test. State law may add stronger requirements.