Is every healthcare business a HIPAA covered entity?
No. HHS defines a provider as a covered entity when it conducts specified standard electronic transactions. A company may instead be a business associate when its work for a covered entity involves protected health information.
Map which entity collects, receives, stores, or sends the information and what services it performs for customers. HHS guidance says cloud providers maintaining electronic protected health information for a covered entity or business associate can have business-associate duties, including when the information is encrypted.1
Use that map to answer the insurance application and customer security questions. Confirm your legal status with counsel, then ask the broker which proposed terms address your data, vendors, and incident duties.1,4
Read the Healthcare Insurance Buying Guide
7 documents, numbered as cited. Open the sources
Sources and Further Reading for Healthcare
Want someone to handle this for you?
Spot, which publishes this research, gets quotes from 50+ providers, picks the options that fit your coverage and budget, and manages renewals after you buy. The first consultation is free. Book a free consultation