Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Is it…

Is our organisation a HIPAA covered entity, a business associate, or neither?

11 decision points

Add to board memo

The short answer

Recommendation
Answer the eleven role questions from the facts, in order, with counsel, and record the role the method gives: covered entity, covered entity (hybrid), business associate, subcontractor business associate, neither, or not settled. Treat any Not sure as not settled until the fact is found.
Reasoning
The Rules attach to what you do with protected health information. A provider that never sends a standard transaction electronically is not a covered entity. A hosting or billing supplier for a clinic is a business associate whether or not it has signed an agreement, and a signed agreement does not make a supplier that does nothing with the information one. Taking a Not sure as a No could leave a duty unmet, so a Not sure keeps the result not settled. The role also scopes everything after it, which is why counsel confirms it.
Considerations
  • A covered entity can also be a business associate of another covered entity, and a business associate can be a subcontractor of another, so the result can name more than one role.
  • A hybrid entity needs a written designation of its health care components. Without one, the Rules read as applying to the whole entity.
  • Neither does not end the matter. Customer contracts may ask you to follow the Security Rule, and other laws may apply to health information you hold.
  • The result is about role only. It does not say which safeguards you need, whether an event is a breach, or what a contract must say.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartYou need to know which HIPAA role, if any, applies to youStepGather the facts with counsel before you answerDecisionAre you a health plan or a clearinghouse?DecisionDo you furnish, bill for or get paid for health care?DecisionDo you send standard transactions electronically?DecisionAre you a provider that sends standard transactions electronically?DecisionDoes the same legal entity also run non-covered activities?DecisionHave you designated your health care components in writing?StepRecord: covered entity, hybrid entityStepRecord: covered entity, the Rules apply to the whole entityDecisionFor a covered entity, do you handle its PHI or serve it, as listed?DecisionIs every use you make within one of the four exceptions?DecisionWould every use you make be within one of the four exceptions?StepRecord: business associateDecisionHas a business associate delegated PHI work to you?StepRecord: subcontractor business associateDecisionHas any step above recorded a role?OutcomeRole settled: take each role to its workOutcomeNeither: HIPAA does not apply to you by roleOutcomeNot settled: ask counsel and find the missing facts

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 20 steps.

  1. Start

    You need to know which HIPAA role, if any, applies to you

    HIPAA assigns duties by role, and the role comes from what your organisation does with protected health information (PHI). A signed agreement does not create it and a missing one does not remove it. The questions below follow the pack's role test, one row at a time, and give a role, no role, or Not settled. This is not legal advice: counsel confirms the result.

    In the pack

  2. Step

    Gather the facts with counsel before you answer

    Find out what the organisation does with health information, who its customers are (plans, providers, clearinghouses or other business associates), whether it sends claims or other standard transactions electronically, which suppliers hold health information for it, and whether any written designation of health care components exists. The security official owns the assessment. Answer from the facts and record where each one comes from.

    In the pack

  3. Decision

    Are you a health plan or a clearinghouse?

    A health plan provides or pays the cost of medical care under an individual or group plan, including a government programme or an employee group plan with 50 or more participants or one run by someone other than the employer. A clearinghouse converts health information between nonstandard and standard formats for another entity, or facilitates that processing, as some billing services do. Plans that offer only excepted benefits, and some government-funded programmes, are excluded: answer Not sure and ask counsel.

    In the pack

  4. Decision

    Do you furnish, bill for or get paid for health care?

    This is the health care provider test: care furnished, billed or paid for in the normal course of business. A provider is a covered entity only if it also sends health information electronically in a standard transaction, so a Yes here leads to that question. A plain No ends the covered entity test.

    In the pack

  5. Decision

    Do you send standard transactions electronically?

    Standard transactions include a claim or encounter, a payment or remittance advice, an eligibility check, a referral authorisation and a claim status inquiry. A provider that never sends one, itself or through an agent, is not a covered entity on these answers. Transmissions made for you by a billing service or other agent count as Yes: using one does not take you outside the definition.

    In the pack

  6. Decision

    Are you a provider that sends standard transactions electronically?

    You are not sure whether you are a health plan or clearinghouse, so only one route can still settle you as a covered entity: furnishing health care and sending standard transactions electronically. If both are Yes, you are a covered entity whatever the plan and clearinghouse answers turn out to be. Otherwise the question stays open.

    In the pack

  7. Decision

    Does the same legal entity also run non-covered activities?

    Ask this only of a covered entity. A retail business or a research arm inside the same legal entity is a non-covered activity. If every activity is a covered function, you are not a hybrid entity and the Rules apply to the whole entity.

    In the pack

  8. Decision

    Have you designated your health care components in writing?

    A single legal entity with covered and non-covered functions is a hybrid entity only if it has designated its health care components in writing and kept the record. If you are unsure whether a designation was made, find the written record before you answer.

    In the pack

  9. Step

    Record: covered entity, hybrid entity

    The Security Rule applies to your health care components. The business associate arrangement rules apply to the whole entity. Keep the written designation for six years. In the pack the executive sponsor decides the designation with legal counsel, and your governance may name someone else.

    In the pack

  10. Step

    Record: covered entity, the Rules apply to the whole entity

    The Security Rule applies to all the electronic PHI you create, receive, maintain or transmit, and you need a written contract with each business associate that handles it. If you run non-covered activities but made no written designation, the Rules read as applying to the whole entity, and counsel confirms.

    In the pack

  11. Decision

    For a covered entity, do you handle its PHI or serve it, as listed?

    Three tests, answered together. First: you create, receive, maintain or transmit PHI on its behalf (claims processing, billing, data analysis, hosting). Second: you provide legal, actuarial, accounting, consulting or similar services involving PHI. Third: data transmission with routine access, or a personal health record for a covered entity. Yes if any one is Yes. A mere conduit (transmission only, at most temporary storage) and a person whose functions do not involve PHI, with only incidental access and reasonable safeguards, are a No. Hosting or storing PHI is never a conduit, even if you never look at it (P31-A05; HHS guidance).

    In the pack

  12. Decision

    Is every use you make within one of the four exceptions?

    The definition has four exceptions: a covered entity disclosing to a provider for treatment of the individual; a plan sponsor receiving information from a group health plan; a government agency determining eligibility for or enrolment in a government health plan; and a covered entity in an organized health care arrangement. Only when every use you make falls inside one are you not a business associate by that use.

    In the pack

  13. Decision

    Would every use you make be within one of the four exceptions?

    At least one of the three tests is Not sure and none is Yes. Only a Yes to the exceptions question lets the business associate question close as No, and a No or Not sure leaves it open. You then go to counsel with the facts.

    In the pack

  14. Step

    Record: business associate

    Where the Rules provide, they apply to you directly, and the Security Rule's administrative, physical, technical and documentation requirements apply to you as they do to a covered entity. You need a written agreement with each covered entity you serve and with each subcontractor. A covered entity can also be a business associate of another covered entity.

    In the pack

  15. Decision

    Has a business associate delegated PHI work to you?

    You are a subcontractor business associate if another business associate has delegated a function, activity or service to you in which you create, receive, maintain or transmit PHI on its behalf. A cloud host for a billing company that is itself a business associate is the usual case. You are then a business associate of that business associate.

    In the pack

  16. Step

    Record: subcontractor business associate

    The same duties apply to you as to any business associate. The business associate above you must hold a written agreement with you before it gives you PHI, and you must do the same with any subcontractor of your own, so the chain continues downward.

    In the pack

  17. Decision

    Has any step above recorded a role?

    A covered entity can also be a business associate, and a business associate can be a subcontractor, so more than one role can be recorded. If a role was recorded, take each one to its work. If none was, the answers settle on neither a covered entity nor a business associate.

    In the pack

  18. Outcome

    Role settled: take each role to its work

    Have counsel confirm the result and any answer marked Not sure, then your approver under your governance signs it off (the pack names the executive sponsor). For each role, list the 22 standards of the Security Rule, run a security risk analysis, review the business associate agreements, prepare the breach assessment procedure and measure where you stand. The result is about role only: it does not say which safeguards you need or whether an event is a breach. Reassess at least yearly (the pack's default) and when a trigger occurs.

    In the pack

    See also

  19. Outcome

    Neither: HIPAA does not apply to you by role

    On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule. Other laws may apply to health information you hold: state health-privacy and consumer-health data laws, which vary by state; the FTC Health Breach Notification Rule (16 CFR Part 318), for vendors of personal health records outside HIPAA; and 42 CFR Part 2, on substance use disorder patient records. Ask counsel which apply. Keep the answers and counsel's confirmation, and reassess when you start a service for a covered entity, win a different kind of customer or begin sending standard transactions.

    In the pack

  20. Outcome

    Not settled: ask counsel and find the missing facts

    A Not sure keeps the result Not settled until the fact is found. Do not guess to reach a result, and do not use it to scope work. List the open questions, find the facts (a contract, a service description, a data flow diagram) and take them to counsel. Where a billing service sends your transactions, they count as yours; find out whether one does.

    In the pack

Practical checklist

  1. Gather the facts with counsel first, and record where each answer comes from.
  2. Answer the covered entity questions, then the hybrid questions if you are one.
  3. Answer the business associate questions, including the four exceptions, and the subcontractor question.
  4. Record every role found, or neither, or not settled with the questions still open.
  5. Have counsel confirm the result and each Not sure, then your approver under your governance signs it off (the pack names the executive sponsor).
  6. Reassess at least once a year (the pack's default) and on any trigger, such as a new kind of customer or a new service that handles health information.

Evidence to have ready

  • The eleven answers, each with its fact, its source and the reasoning.
  • The role the method gave and whether it was settled.
  • Counsel's confirmation and the approver's sign-off, with dates.
  • For a hybrid entity, the written designation of the health care components, kept for six years.

Assumptions

  • You hold, or may hold, health information about individuals in the United States, and you can find out what your organisation does with it, with counsel.
  • You have the facts to hand: your customers, your services, whether you send standard transactions electronically, and any designation of health care components.
  • The method follows the HIPAA definitions as the pack states them, as read on 18 October 2026. It is not legal advice, and counsel confirms the role.

Not covered here