HIPAA Applicability Assessment
Works out whether an organisation is a covered entity, a business associate, a subcontractor, a hybrid entity, neither, or not yet settled.
Available soon
Answer it online instead: Does HIPAA apply to us?About 8 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 82 KB
- Length
- 13 sheets
- Version
- 1.1
- Updated
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Gather the facts first, with legal counsel: what the organisation does with health information, who its customers are (health plans, providers, clearinghouses or other business associates), whether it sends claims or other standard transactions electronically, which suppliers hold health information for it, and any written designation of health care components. The security official owns the assessment. |
| 2 | On the Questions sheet, enter the organisation's details and answer RQ-01 to RQ-11 in order, from the drop-down lists: Yes, No or Not sure. For each, record the fact and where it comes from (a contract, a service description, a data flow diagram), then your reasoning. The Check column says what is still missing, and which questions your earlier answers make unnecessary. |
| 3 | Answer Not sure only when you do not know. A Not sure keeps the result Not settled until the fact is found, and a question left blank counts as Not sure. Do not guess to reach a result. An employer or union that only sponsors a group health plan for its staff, and runs no plan of its own, answers RQ-01 Plan sponsor only, not Not sure: the plan, not the sponsor, is the covered entity, and the result points to 164.314(b) for the plan documents. |
| 4 | RQ-04 is asked only if RQ-03 is Yes or Not sure. RQ-09 is asked only if any of RQ-05, RQ-06 or RQ-07 is Yes or Not sure. RQ-10 and RQ-11 are asked only of a covered entity. The Decision Table sheet shows each row of the method and which rows match your answers. |
| 5 | Your role depends on what the organisation does with protected health information, not on whether an agreement has been signed (HR-01). A missing agreement does not remove a role, and a signed one is not what creates it. Answer from the facts. |
| 6 | Read the Result sheet: the role, whether it is settled, what it means for the Security Rule, what to do next, the questions still open and any note that applies. If you are a covered entity, check that the answers to RQ-10 and RQ-11 are in line with your written designation, if any. |
| 7 | Have counsel confirm the result, and any answer marked Not sure, before you rely on it. Then the executive sponsor approves it. Record both in the sign-off on the Result sheet (HR-01). |
| 8 | Take the result to the Security Rule Safeguard Register, the Security Risk Analysis Method, the Business Associate Agreement Security Terms, the Breach Assessment & Notification Decision Procedure and the HIPAA Security Rule Readiness Self-Assessment; the What It Means sheet names the ones each result leads to. Reassess at least once a year and on any trigger on the Result sheet. |
| 9 | The Example sheet shows a completed assessment for an invented organisation, and the Worked Cases sheet runs 15 typical cases through the same formulas. Neither records your own assessment. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule HR-01: "The role comes from what the organisation does with protected health information, not from a signed agreement. Decide it with the applicability assessment, record the answers, and have counsel confirm."
EXAMPLE: a US software-as-a-service provider with about 250 staff, whose hosted patient-messaging and appointment service is used by about 60 clinics and small hospital groups. It handles its clinic customers' patient data on their behalf, so the method gives business associate. Assessed on 2026-09-30 by Max Okafor (EXAMPLE), Head of Information Security, the security official.
Tailoring — group of companies: a hybrid entity is a single legal entity, so complete one workbook for each legal entity that may be a covered entity or a business associate. If legally separate covered entities under common ownership or control have designated themselves as one affiliated covered entity (164.105(b)), record that and ask counsel.
Tailoring — small organisation: size does not decide a role. A small practice that sends claims electronically is a covered entity, and a small software company that hosts patient data for a clinic is a business associate.
Not covered here: the Privacy Rule's duties on how protected health information may be used and disclosed, State laws, and other regimes that may apply to health information. The proposed rule published at 90 FR 898 is a proposal. It is not part of the text this pack applies. Counsel confirms its status before any document is relied on.
Limitations: This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.
Questions
Role questions
Answer every question from the list, and record the fact, its source and your reasoning. Yellow cells are yours; grey cells are calculated. Blank counts as Not sure.
| Organisation (legal name) | [[Legal name of the organisation]] | ||||||
| What it does with health information | [[One sentence: the services it provides and to whom]] | ||||||
| Date of the assessment | |||||||
| Assessed by | [[Name and role of the person assessing]] | ||||||
| Months until the next review (the pack's default is 12; the Rules set none) | [[12]] | ||||||
| ID | Question | Source in the Rules | Your answer | Fact and its source | Reasoning | Check | When it is asked |
|---|---|---|---|---|---|---|---|
| RQ-01 | Does your organisation provide, or pay the cost of, medical care for individuals under an individual or group plan: a health insurer, an HMO, a government programme such as Medicare or Medicaid, or an employee group health plan that has 50 or more participants or is administered by someone other than the employer? An employer or union that only sponsors a group health plan for its staff is the plan sponsor, not the health plan: the plan is the covered entity. If that is you, answer Plan sponsor only (164.314(b), 164.504(f)). Plans that only provide the excepted benefits listed in the Public Health Service Act, and some government-funded programmes, are excluded from the definition: answer Not sure and ask counsel. | 160.103 "Covered entity" (1) and "Health plan" | Answer this question | Always | |||
| RQ-02 | Does your organisation process health information received from another entity from a nonstandard format into standard data elements or a standard transaction, or the reverse, or facilitate the processing of information in either direction (a health care clearinghouse, including a billing service or repricing company that does this)? | 160.103 "Health care clearinghouse" | Answer this question | Always | |||
| RQ-03 | Does your organisation furnish, bill for, or get paid for health care in the normal course of business (a health care provider)? | 160.103 "Health care provider" | Answer this question | Always | |||
| RQ-04 | Do you, or does a billing service, clearinghouse or other agent acting for you, transmit any health information in electronic form in connection with a standard transaction: for example a claim or encounter, a payment or remittance advice, an eligibility check, a referral authorisation or a claim status inquiry? Count transmissions made for you by a billing service or other agent as Yes: using one does not take you outside the definition. | 160.103 "Transaction" and "Covered entity" (3); 160.102(a)(3) | Answer this question | Only if RQ-03 is Yes or Not sure. | |||
| RQ-05 | On behalf of a covered entity, and not as one of its own workforce, does your organisation create, receive, maintain or transmit protected health information for a function or activity such as claims processing or administration, data analysis or processing, utilisation review, quality assurance, billing, benefit management, practice management or repricing? Hosting, storing or processing it for them counts. HHS guidance treats a person that only transmits protected health information as a conduit (a courier or its electronic equivalent), with at most temporary storage incident to the transmission, and a person whose functions do not involve protected health information, whose access to it is only incidental, if at all, and for whom reasonable safeguards are in place (a cleaning service, for example), as outside this question, so each answers No. A person that maintains protected health information for a covered entity, even one that never looks at it, answers Yes (P31-A05 lists these cases). | 160.103 "Business associate" (1)(i) | Answer this question | Always | |||
| RQ-06 | Do you provide legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to or for a covered entity, where the service involves disclosure of protected health information to you? | 160.103 "Business associate" (1)(ii) | Answer this question | Always | |||
| RQ-07 | Do you provide data transmission services for protected health information to a covered entity and need routine access to that information (for example a health information organisation or an e-prescribing gateway), or offer a personal health record to individuals on behalf of a covered entity? | 160.103 "Business associate" (3)(i) and (ii) | Answer this question | Always | |||
| RQ-08 | Has another business associate delegated a function, activity or service to you, in which you create, receive, maintain or transmit protected health information on its behalf (you are its subcontractor)? | 160.103 "Business associate" (3)(iii) and "Subcontractor" | Answer this question | Always | |||
| RQ-09 | Is every use you make of the protected health information you handle for others within one of the four exceptions: a disclosure by a covered entity to a health care provider about the treatment of the individual; a plan sponsor receiving information from a group health plan under 164.504(f); a government agency determining eligibility for, or enrolment in, a government health plan; or a covered entity in an organized health care arrangement? | 160.103 "Business associate" (4) | Answer this question | Only if any of RQ-05, RQ-06 or RQ-07 is Yes or Not sure. | |||
| RQ-10 | Does the same legal entity also carry on business activities that are not covered functions (not those of a health plan, health care provider or clearinghouse), for example a retail business or a research arm? | 164.103 "Hybrid entity" (2) | Not needed on your answers | Only if your organisation is a covered entity. | |||
| RQ-11 | Have you designated, in writing, the parts of the entity that are health care components, and kept that record? | 164.103 "Hybrid entity" (3); 164.105(a)(2)(iii)(D) and (c) | Not needed on your answers | Only if RQ-10 is Yes or Not sure. |
Decision Table
The role decision table
HIPAA's role test as 15 rows in 4 groups, written from the definitions in 45 CFR 160.103 and 164.103. In each group the rows are read from the top, and the first that matches the answers decides. Nothing on this sheet is yours to change.
Covered entity: Read from the top; the first row that matches decides.
| Row | When | Result | What the row says | CFR paragraph | Matches the answers? | Decides? |
|---|---|---|---|---|---|---|
| CE-1 | RQ-01 is Yes, or RQ-02 is Yes, or RQ-03 and RQ-04 are both Yes. | yes | You are a covered entity: a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction. | 160.102(a); 160.103 "Covered entity" | No | |
| CE-2 | RQ-01 is No or Plan sponsor only, RQ-02 is No, and either RQ-03 is No or RQ-03 is Yes and RQ-04 is No. | no | You are not a covered entity on these answers. | 160.103 "Covered entity" (3) | No | |
| CE-3 | Any other combination. A question left blank counts as Not sure. | unknown | The covered entity question is not settled. The questions to settle are listed on the Result sheet. | Yes | Decides |
Business associate: Working for a covered entity (RQ-05 to RQ-07), with the exceptions question RQ-09.
| Row | When | Result | What the row says | CFR paragraph | Matches the answers? | Decides? |
|---|---|---|---|---|---|---|
| BA-1 | RQ-05, RQ-06 and RQ-07 are all No. | no | You do not handle protected health information for a covered entity in a way that makes you a business associate. | 160.103 "Business associate" (1) and (3) | No | |
| BA-2 | Any of RQ-05, RQ-06 or RQ-07 is Yes, and RQ-09 is No. | yes | You are a business associate: you do what the definition lists, and none of its four exceptions describes every use you make. | 160.103 "Business associate" (1), (3) and (4) | No | |
| BA-3 | RQ-09 is Yes (and RQ-05, RQ-06 and RQ-07 are not all No). | no | Every use you make is inside one of the four exceptions, so you are not a business associate by that use. | 160.103 "Business associate" (4) | No | |
| BA-4 | Any other combination, for example a Yes or Not sure in RQ-05 to RQ-07 with RQ-09 not answered. | unknown | The business associate question is not settled. | Yes | Decides |
Subcontractor of a business associate: RQ-08.
| Row | When | Result | What the row says | CFR paragraph | Matches the answers? | Decides? |
|---|---|---|---|---|---|---|
| SC-1 | RQ-08 is Yes. | yes | You are a subcontractor of a business associate, which is a business associate too. | 160.103 "Business associate" (3)(iii) and "Subcontractor" | No | |
| SC-2 | RQ-08 is No. | no | No business associate has delegated work involving protected health information to you. | 160.103 "Subcontractor" | No | |
| SC-3 | RQ-08 is Not sure or blank. | unknown | The subcontractor question is not settled. | Yes | Decides |
Hybrid entity: Only for a covered entity (RQ-10 and RQ-11).
| Row | When | Result | What the row says | CFR paragraph | Matches the answers? | Decides? |
|---|---|---|---|---|---|---|
| HY-1 | You are not a covered entity (or that is not settled yet). | n/a | The hybrid entity test applies only to a covered entity, so it is not asked. | 164.103 "Hybrid entity" (1) | Yes | Decides |
| HY-2 | You are a covered entity and RQ-10 is No. | no | All your activities are covered functions, so you are not a hybrid entity and the Rules apply to the whole entity. | 164.103 "Hybrid entity" (2) | No | |
| HY-3 | You are a covered entity, RQ-10 is Yes and RQ-11 is Yes. | yes | You are a hybrid entity: a single legal entity with covered and non-covered functions that has designated its health care components. | 164.103 "Hybrid entity" (1) to (3); 164.105(a)(2)(iii)(D) and (c) | No | |
| HY-4 | You are a covered entity, RQ-10 is Yes and RQ-11 is No. | no | Without the written designation you are not a hybrid entity by the definition, so the Rules read as applying to the whole entity (the note below the result says so). | 164.103 "Hybrid entity" (3) | No | |
| HY-5 | You are a covered entity and RQ-10 is Not sure or blank, or RQ-10 is Yes and RQ-11 is Not sure or blank. | unknown | The hybrid entity question is not settled. | Yes |
Combining the four tests
The result is Not settled if the covered entity, business associate or subcontractor test is unknown, or the hybrid entity test is unknown for a covered entity. Otherwise the roles found are listed, joined by "and".
A covered entity is a hybrid entity only when RQ-10 and RQ-11 are both Yes. If no role is found, the result is Neither a covered entity nor a business associate.
The questions still open are listed in the order RQ-01 to RQ-07, RQ-09, RQ-08, RQ-10, RQ-11: only those whose answer would change an unknown test, and only if they are Not sure or blank.
Working (calculated; the Result sheet reads these)
| Covered entity test (yes, no or unknown) | unknown | ||||
| Business associate test | unknown | ||||
| Subcontractor test | unknown | ||||
| Hybrid entity test | n/a | ||||
| Still open: RQ-01 | RQ-01 | ||||
| Still open: RQ-02 | RQ-02 | ||||
| Still open: RQ-03 | RQ-03 | ||||
| Still open: RQ-04 | RQ-04 | ||||
| Still open: RQ-05 | RQ-05 | ||||
| Still open: RQ-06 | RQ-06 | ||||
| Still open: RQ-07 | RQ-07 | ||||
| Still open: RQ-09 | RQ-09 | ||||
| Still open: RQ-08 | RQ-08 | ||||
Still open: RQ-10
Still open: RQ-11
Role 1: covered entity
Role 2: business associate
Role 3: subcontractor
Roles joined
| Any test unknown? | TRUE | ||||
| Result label | Not settled | ||||
| State | not settled | ||||
| Questions still open | RQ-01, RQ-02, RQ-03, RQ-04, RQ-05, RQ-06, RQ-07, RQ-09, RQ-08 | ||||
Note: neither
Note: no written designation
Note: transactions sent for you
Note: plan sponsor only
Notes printed
What It Means
What each result means
What the Security Rule asks of you in each role, where it comes from in the Rules, and which documents of this pack to take it to. Not legal advice: counsel confirms.
| Result | What it means | Where it comes from | Next steps |
|---|---|---|---|
| Covered entity | The Security Rule applies to you for all the electronic protected health information you create, receive, maintain or transmit. A business associate may handle it for you only under a written contract or other arrangement that you have obtained (164.308(b)). | 160.102(a); 164.104; 164.306(a); 164.308(b); 164.314(a) | List the 22 standards in the P31-A03 Security Rule Safeguard Register, run the P31-A04 Security Risk Analysis Method, review each business associate agreement with the P31-A05 Business Associate Agreement Security Terms, prepare the P31-A06 Breach Assessment & Notification Decision Procedure, and measure where you stand with the P31-A09 HIPAA Security Rule Readiness Self-Assessment. |
| Covered entity (hybrid entity) | The Security Rule applies to your health care components. The business associate arrangement rules (164.314 and 164.504) apply to the whole entity. You keep the designation in writing for six years from its creation or the date it was last in effect, whichever is later (164.105(c)(2)). | 164.105(a)(1), (a)(2)(iii), (c) | Keep the written designation of your health care components (HD-05). Then work through the P31-A03 Security Rule Safeguard Register for those components, the P31-A04 Security Risk Analysis Method, the P31-A05 Business Associate Agreement Security Terms (the business associate arrangement rules reach the whole entity), the P31-A06 Breach Assessment & Notification Decision Procedure and the P31-A09 HIPAA Security Rule Readiness Self-Assessment. |
| Business associate | Where the Rules provide, they apply to you directly. The Security Rule's administrative, physical, technical and documentation requirements apply to you in the same way as to a covered entity (164.308, 164.310, 164.312, 164.316). A covered entity may let you create, receive, maintain or transmit electronic protected health information on its behalf only if it obtains assurances, documented in a written contract or other arrangement with you (164.308(b)(1), (b)(3)); the Privacy Rule has a matching rule for protected health information in any form (164.502(e)). You must have one with each subcontractor (164.308(b)(2)). Counsel confirms the agreement. | 160.102(b); 164.104(b); 42 U.S.C. 17931; 164.308(b); 164.314(a) | List the 22 standards in the P31-A03 Security Rule Safeguard Register, run the P31-A04 Security Risk Analysis Method, check your agreements with each covered entity you serve and each subcontractor with the P31-A05 Business Associate Agreement Security Terms, prepare the P31-A06 Breach Assessment & Notification Decision Procedure, and measure where you stand with the P31-A09 HIPAA Security Rule Readiness Self-Assessment. |
| Subcontractor business associate | You are a business associate of the business associate that delegated work to you. The same duties apply to you, and the business associate must hold a written agreement with you before it gives you protected health information. | 160.103 "Business associate" (3)(iii); 164.308(b)(2); 164.314(a)(2)(iii) | Do the same work as a business associate: the P31-A03 Security Rule Safeguard Register, P31-A04 Security Risk Analysis Method, P31-A05 Business Associate Agreement Security Terms for the agreement with the business associate that delegated to you, P31-A06 Breach Assessment & Notification Decision Procedure and P31-A09 HIPAA Security Rule Readiness Self-Assessment. |
| Neither a covered entity nor a business associate | On these answers the HIPAA Rules do not apply to your organisation by its role. The note under the result adds what to keep in mind. | 160.102; 160.103 | No further work in this pack follows from your role alone. If a customer contract asks you to follow the Security Rule, or other laws cover the health information you hold, the P31-A03 Security Rule Safeguard Register can still serve as a reference. Keep the answers and counsel's confirmation, and reassess when one of the triggers below happens. |
| Not settled | The answers do not yet settle your role. Settle the questions listed under Questions still open. Until then, do not use the result to scope work. | Settle the questions listed under Questions still open, with the facts and counsel. No role is stated until each is settled. |
A covered entity can also be a business associate of another covered entity (160.103 "Business associate" (2)), and a business associate can be a subcontractor of another. When the answers give more than one role, the label joins them and the Result sheet prints the meaning of each.
Each row names the paragraphs of 45 CFR Parts 160 and 164 it comes from; the pack's documents help with the work, and using one does not by itself show that a requirement is met. A reference says what its source asks, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement, and it does not say that an organisation is compliant or certified. The Rules provide no certificate of compliance for an organisation to hold.
Result
Result and the reasoning recorded
The role the decision table gives, whether it is settled, what it means, what to confirm before you rely on it, and the sign-off. Everything above the sign-off is calculated.
Your assessment, dated [date not entered]. The worked example is on the Example sheet.
The result
| Role | Not settled | |||
|---|---|---|---|---|
| State | not settled | |||
| Hybrid entity | Not applicable: the hybrid entity test is for a covered entity | |||
| What it means | The answers do not yet settle your role. Settle the questions listed under Questions still open. Until then, do not use the result to scope work. | |||
Where it comes from (CFR)
| Next steps | Settle the questions listed under Questions still open, with the facts and counsel. No role is stated until each is settled. | |||
| Questions still open | RQ-01, RQ-02, RQ-03, RQ-04, RQ-05, RQ-06, RQ-07, RQ-09, RQ-08 | |||
| Notes | None | |||
| Reasoning recorded | 9 questions still need an answer, a fact, a source or the reasoning | |||
Next review due
Review at least once a year (the pack's default, not the Rules'), and at once on any of the triggers below.
Notes the result can carry
| Note | Printed when | Sentence | ||
|---|---|---|---|---|
| Neither | The result is Neither a covered entity nor a business associate. | On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule, an employer that only sponsors a group health plan is not itself a covered entity (the plan documents may still bind it, 164.314(b)), and other laws may apply to health information you hold, such as state health privacy laws and, for a consumer health app or personal health record vendor outside HIPAA, the FTC Health Breach Notification Rule (16 CFR Part 318). Counsel confirms. | ||
| No written designation | You are a covered entity, RQ-10 is Yes and RQ-11 is No. | A covered entity with non-covered functions that has not designated its health care components is not a hybrid entity by the definition in 164.103, so the Rules read as applying to the whole entity. Counsel confirms. | ||
| Transactions sent for you | The covered entity question is not settled, RQ-03 is Yes and RQ-04 is Not sure. | Find out whether a billing service, clearinghouse or other agent sends standard transactions for you. If one does, they count as yours and you are a covered entity. Counsel confirms. | ||
| Plan sponsor only | RQ-01 is Plan sponsor only. | You answered Plan sponsor only. An employer or union that only sponsors a group health plan for its staff is not itself a covered entity: the group health plan is. The plan's documents must oblige the plan sponsor to reasonably and appropriately safeguard the electronic protected health information it creates, receives, maintains or transmits for the plan, except when the only such information disclosed to the sponsor is disclosed under 164.504(f)(1)(ii) or (iii) or as authorised under 164.508 (164.314(b)). This assessment does not decide the plan's own position. Counsel confirms, and checks the plan documents. | ||
The reasoning, as recorded on the Questions sheet
| Question | Answer | Fact and its source | Reasoning | |
|---|---|---|---|---|
RQ-01
RQ-02
RQ-03
RQ-04
RQ-05
RQ-06
RQ-07
RQ-08
RQ-09
RQ-10
RQ-11
Before you rely on it
This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.
Rule HR-01: "The role comes from what the organisation does with protected health information, not from a signed agreement. Decide it with the applicability assessment, record the answers, and have counsel confirm."
Being a business associate depends on what the organisation does with protected health information, not on whether an agreement has been signed. Counsel confirms the result, and confirms every answer marked Not sure, before it is used to scope work.
The result is about your role only. It does not say which safeguards you need, whether an event is a breach, or what a contract must say: the documents named under Next steps help with that work.
The Rules treat a covered entity that has not designated its health care components as one whole entity. If you are unsure whether a designation was made, find the written record before you answer RQ-11.
The proposed rule published at 90 FR 898 is a proposal. It is not part of the text this pack applies. Counsel confirms its status before any document is relied on.
Reassess when
• You start or stop a service that handles protected health information for a covered entity, or for another business associate.
• You win a customer of a different kind, for example a health plan, a clinic or a clearinghouse.
• You start or stop sending claims or other standard transactions electronically, or you change the billing service that sends them for you.
• You add a non-covered business activity to a covered entity, or change which parts you designated as health care components.
• You merge with, buy or sell a business, or change the legal entities in the group.
• A customer, a supplier or an authority asks you to sign, change or end a business associate agreement, or a supplier starts to hold protected health information for you.
• Counsel tells you the law, HHS guidance or a court ruling has changed, or the proposed Security Rule changes become final.
• Your review date arrives (the pack's default is [[12]] months; the Rules set no interval).
Confirmation and approval (HR-01)
| Step | Date | Who | Reference | |
|---|---|---|---|---|
| Assessed by | [[YYYY-MM-DD]] | [[Security official]] | [[file reference of the assessment]] | |
| Confirmed by counsel | [[YYYY-MM-DD]] | [[Counsel's name]] | [[counsel's letter or e-mail reference]] | |
| Approved by the executive sponsor | [[YYYY-MM-DD]] | [[Executive sponsor]] | [[minute or ticket reference]] | |
Example
Worked example: Acme Corp (EXAMPLE)
EXAMPLE: a US software-as-a-service provider with about 250 staff, whose hosted patient-messaging and appointment service is used by about 60 clinics and small hospital groups. Assessed on 2026-09-30 by Max Okafor (EXAMPLE), Head of Information Security, the security official. Every value on this sheet is invented. The answers below run through the same formulas as the Questions sheet.
Assumptions of the example
• The organisation is an invented EXAMPLE; its name is a placeholder.
• It provides a hosted service to clinics and handles their patients' protected health information on their behalf, so it is a business associate. It is not a health plan, a clearinghouse or a health care provider.
• It uses a cloud hosting provider and a customer-support tool that can reach protected health information, so those two are its subcontractors and are business associates too.
• It is not listed on an exchange and holds no licence under the New York Insurance Law, Banking Law or Financial Services Law, so the SEC and New York rows of the incident pack do not apply to it.
• Its customers' contracts, not this pack, set what it must report to them and by when; the HIPAA clocks are P09's and P18's.
| ID | Question (short name) | EXAMPLE answer | Fact and its source | Reasoning |
|---|---|---|---|---|
| RQ-01 | Health plan | No | EXAMPLE: it sells software. It does not run, sell or pay for a health plan. Source: the company's service description. | Not a health plan. |
| RQ-02 | Clearinghouse | No | EXAMPLE: it does not convert health information between nonstandard and standard formats for others. Source: the architecture overview. | Messages and appointment data pass through unchanged. Not a clearinghouse. |
| RQ-03 | Provider | No | EXAMPLE: it furnishes no health care and bills nobody for it. Its customers are clinics and small hospital groups. Source: the customer contracts. | Not a health care provider, so RQ-04 is not asked. |
| RQ-04 | Standard transactions | Not asked: RQ-03 is No. | ||
| RQ-05 | Function for a covered entity | Yes | EXAMPLE: it hosts and processes the clinics' appointment and patient-message data on their behalf. Source: the master services agreement and the data flow diagram. | Hosting and processing protected health information for a covered entity, not as its staff. The definition lists this kind of function. |
| RQ-06 | Service to a covered entity | No | EXAMPLE: the contract is for the hosted application; it sells no consulting, accounting or similar service. Source: the order form. | The role comes from RQ-05. Counsel confirms that no further service is bundled in. |
| RQ-07 | Transmission or personal health record | No | EXAMPLE: it is not a health information organisation or e-prescribing gateway and offers no personal health record. Source: the product list. | Not in the transmission or personal health record paragraphs. |
| RQ-08 | Subcontractor | No | EXAMPLE: its customers are covered entities, not business associates. Source: the customer list checked against the contracts. | Nobody has delegated work to it as a subcontractor. It has subcontractors of its own: a cloud hosting provider and a support ticketing tool. |
| RQ-09 | Exceptions | No | EXAMPLE: it uses the data only to run the service the clinics buy. Source: the master services agreement. | None of the four exceptions describes that use. |
| RQ-10 | Non-covered functions | Not asked: it is not a covered entity. | ||
| RQ-11 | Designation | Not asked: it is not a covered entity. |
The result for the example
| Role | Business associate | |||
| State | settled | |||
| What it means | Where the Rules provide, they apply to you directly. The Security Rule's administrative, physical, technical and documentation requirements apply to you in the same way as to a covered entity (164.308, 164.310, 164.312, 164.316). A covered entity may let you create, receive, maintain or transmit electronic protected health information on its behalf only if it obtains assurances, documented in a written contract or other arrangement with you (164.308(b)(1), (b)(3)); the Privacy Rule has a matching rule for protected health information in any form (164.502(e)). You must have one with each subcontractor (164.308(b)(2)). Counsel confirms the agreement. | |||
| Where it comes from (CFR) | 160.102(b); 164.104(b); 42 U.S.C. 17931; 164.308(b); 164.314(a) | |||
| Next steps | List the 22 standards in the P31-A03 Security Rule Safeguard Register, run the P31-A04 Security Risk Analysis Method, check your agreements with each covered entity you serve and each subcontractor with the P31-A05 Business Associate Agreement Security Terms, prepare the P31-A06 Breach Assessment & Notification Decision Procedure, and measure where you stand with the P31-A09 HIPAA Security Rule Readiness Self-Assessment. | |||
| Questions still open | None | |||
| Notes | None | |||
| Confirmed by counsel | Legal counsel (EXAMPLE), on 2026-09-30 (EXAMPLE) | |||
| Next review due | 30 Sep 2027 | |||
Working for the example (calculated)
| Covered entity test (yes, no or unknown) | no | ||
| Business associate test | yes | ||
| Subcontractor test | no | ||
| Hybrid entity test | n/a | ||
Still open: RQ-01
Still open: RQ-02
Still open: RQ-03
Still open: RQ-04
Still open: RQ-05
Still open: RQ-06
Still open: RQ-07
Still open: RQ-09
Still open: RQ-08
Still open: RQ-10
Still open: RQ-11
Role 1: covered entity
| Role 2: business associate | Business associate | ||
Role 3: subcontractor
| Roles joined | Business associate | ||
| Any test unknown? | FALSE | ||
| Result label | Business associate | ||
| State | settled | ||
Questions still open
Note: neither
Note: no written designation
Note: transactions sent for you
Note: plan sponsor only
Notes printed
Worked Cases
The facts' 15 worked cases run through the decision table's formulas. An empty answer cell counts as Not sure. Add a case of your own on a blank row to see how the method decides it.
| Case | What the case is | RQ-01 Health plan | RQ-02 Clearinghouse | RQ-03 Provider | RQ-04 Standard transactions | RQ-05 Function for a covered entity | RQ-06 Service to a covered entity | RQ-07 Transmission or personal health record | RQ-08 Subcontractor | RQ-09 Exceptions | RQ-10 Non-covered functions | RQ-11 Designation | Covered entity test | Business associate test | Subcontractor test | Hybrid test | Result | State | Questions still open | Notes | Expected | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WC-01 | The EXAMPLE: a hosted service for clinics | No | No | No | Yes | No | No | No | No | no | yes | no | n/a | Business associate | settled | Business associate | Agrees | |||||
| WC-02 | A clinic that bills insurers electronically | No | No | Yes | Yes | No | No | No | No | No | yes | no | no | no | Covered entity | settled | Covered entity | Agrees | ||||
| WC-03 | A provider that never transmits a standard transaction electronically, itself or through an agent | No | No | Yes | No | No | No | No | No | no | no | no | n/a | Neither a covered entity nor a business associate | settled | On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule, an employer that only sponsors a group health plan is not itself a covered entity (the plan documents may still bind it, 164.314(b)), and other laws may apply to health information you hold, such as state health privacy laws and, for a consumer health app or personal health record vendor outside HIPAA, the FTC Health Breach Notification Rule (16 CFR Part 318). Counsel confirms. | Neither a covered entity nor a business associate | Agrees | ||||
| WC-04 | A health plan that also runs an analytics service for another plan | Yes | No | No | Yes | No | No | No | No | No | yes | yes | no | no | Covered entity and Business associate | settled | Covered entity and Business associate | Agrees | ||||
| WC-05 | A retailer with a designated pharmacy component | No | No | Yes | Yes | No | No | No | No | Yes | Yes | yes | no | no | yes | Covered entity (hybrid entity) | settled | Covered entity (hybrid entity) | Agrees | |||
| WC-06 | A retailer with a pharmacy and no written designation | No | No | Yes | Yes | No | No | No | No | Yes | No | yes | no | no | no | Covered entity | settled | A covered entity with non-covered functions that has not designated its health care components is not a hybrid entity by the definition in 164.103, so the Rules read as applying to the whole entity. Counsel confirms. | Covered entity | Agrees | ||
| WC-07 | A cloud provider hosting for a billing company that is itself a business associate | No | No | No | No | No | No | Yes | no | no | yes | n/a | Subcontractor business associate | settled | Subcontractor business associate | Agrees | ||||||
| WC-08 | A law firm whose clients are covered entities and which receives PHI | No | No | No | No | Yes | No | No | No | no | yes | no | n/a | Business associate | settled | Business associate | Agrees | |||||
| WC-09 | A hospital's treatment referral partner, only | No | No | No | Yes | No | No | No | Yes | no | no | no | n/a | Neither a covered entity nor a business associate | settled | On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule, an employer that only sponsors a group health plan is not itself a covered entity (the plan documents may still bind it, 164.314(b)), and other laws may apply to health information you hold, such as state health privacy laws and, for a consumer health app or personal health record vendor outside HIPAA, the FTC Health Breach Notification Rule (16 CFR Part 318). Counsel confirms. | Neither a covered entity nor a business associate | Agrees | ||||
| WC-10 | A courier or network carrier that only transmits PHI | No | No | No | No | No | No | No | no | no | no | n/a | Neither a covered entity nor a business associate | settled | On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule, an employer that only sponsors a group health plan is not itself a covered entity (the plan documents may still bind it, 164.314(b)), and other laws may apply to health information you hold, such as state health privacy laws and, for a consumer health app or personal health record vendor outside HIPAA, the FTC Health Breach Notification Rule (16 CFR Part 318). Counsel confirms. | Neither a covered entity nor a business associate | Agrees | |||||
| WC-11 | Nothing answered | unknown | unknown | unknown | n/a | Not settled | not settled | RQ-01, RQ-02, RQ-03, RQ-04, RQ-05, RQ-06, RQ-07, RQ-09, RQ-08 | Not settled | Agrees | ||||||||||||
| WC-12 | A provider whose billing service sends its claims | No | No | Yes | Yes | No | No | No | No | No | yes | no | no | no | Covered entity | settled | Covered entity | Agrees | ||||
| WC-13 | A provider unsure about transactions | No | No | Yes | Not sure | No | No | No | No | No | unknown | no | no | n/a | Not settled | not settled | RQ-04 | Find out whether a billing service, clearinghouse or other agent sends standard transactions for you. If one does, they count as yours and you are a covered entity. Counsel confirms. | Not settled | Agrees | ||
| WC-14 | A hybrid candidate unsure about designation | Yes | No | No | No | No | No | No | Yes | Not sure | yes | no | no | unknown | Not settled | not settled | RQ-11 | Not settled | Agrees | |||
| WC-15 | Neither on every answer | No | No | No | No | No | No | No | no | no | no | n/a | Neither a covered entity nor a business associate | settled | On these answers the HIPAA Rules do not apply to your organisation by its role. Contracts with customers may still ask you to follow the Security Rule, an employer that only sponsors a group health plan is not itself a covered entity (the plan documents may still bind it, 164.314(b)), and other laws may apply to health information you hold, such as state health privacy laws and, for a consumer health app or personal health record vendor outside HIPAA, the FTC Health Breach Notification Rule (16 CFR Part 318). Counsel confirms. | Neither a covered entity nor a business associate | Agrees |
Lists
| RoleAnswer | PlanAnswer |
|---|---|
| Yes | Yes |
| No | No |
| Not sure | Not sure |
Plan sponsor only
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Covered entity | A health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form in connection with a transaction covered by the HIPAA Rules (160.103). RQ-01 to RQ-04 test it. |
| Business associate | In outline: a person who, on behalf of a covered entity and not as one of its workforce, creates, receives, maintains or transmits protected health information for a regulated function or activity; or who provides listed services to a covered entity that involve disclosure of protected health information to it. It includes a data transmission service with routine access, a person offering a personal health record on behalf of a covered entity, and a subcontractor. Four exceptions apply (160.103). A covered entity may be a business associate of another covered entity. |
| Subcontractor | A person to whom a business associate delegates a function, activity or service, other than in the capacity of a member of the workforce of that business associate (160.103). Where it creates, receives, maintains or transmits protected health information for the business associate, it is a business associate too. |
| Protected health information (PHI) | Individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium, with four exclusions: education records under FERPA, certain related records, employment records held by a covered entity as employer, and information about a person dead for more than 50 years (160.103). |
| Electronic protected health information (ePHI) | The part of protected health information that is transmitted by electronic media or maintained in electronic media (160.103). It is what the Security Rule protects. |
| Workforce | Employees, volunteers, trainees and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of that covered entity or business associate, whether or not they are paid by it (160.103). A person acting as workforce is not a business associate of the organisation they work for. |
| Hybrid entity | A single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates health care components (164.103). Without the designation it is not a hybrid entity. |
| Health care component | A component of a hybrid entity that the entity has designated in writing (164.103; 164.105(a)(2)(iii)(D)). The covered entity keeps the designation for 6 years from its creation or last effect, whichever is later (164.105(c)). |
| Affiliated covered entity | Legally separate covered entities under common ownership or control that designate themselves as a single covered entity for the purposes of the Rules, with the designation documented (164.105(b)). Ask counsel how it changes your answers. |
| Standard transaction (transaction) | The transmission of information between two parties to carry out financial or administrative activities related to health care. The types are: (1) Health care claims or equivalent encounter information; (2) Health care payment and remittance advice; (3) Coordination of benefits; (4) Health care claim status; (5) Enrollment and disenrollment in a health plan; (6) Eligibility for a health plan; (7) Health plan premium payments; (8) Referral certification and authorization; (9) First report of injury; (10) Health care claims attachments; (11) Health care electronic funds transfers (EFT) and remittance advice; (12) Other transactions that the Secretary may prescribe by regulation (160.103). RQ-04 asks about these. |
| Not sure | An answer that keeps the result Not settled until the fact is found. A question left blank counts as Not sure. |
| EXAMPLE | A worked example: a US software-as-a-service provider with about 250 staff, whose hosted patient-messaging and appointment service is used by about 60 clinics and small hospital groups, assessed on 2026-09-30. It is on its own sheet and never needs clearing. |
| Retention | The covered entity keeps the record of a hybrid entity designation for 6 years from its creation or last effect, whichever is later (164.105(c)(2)). Keep this assessment with the same care. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 4.3 — Determining the scope of the information security management system | The whole workbook: the HIPAA Rules identified as a requirement on the organisation, and the scope of the management system |
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The whole workbook: the legal requirement identified, its role decided and the decision recorded |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole workbook: the legal and regulatory requirement understood and managed |
| HIPAA — 45 CFR Parts 160 and 164 | § 160.102 — the standards, requirements and implementation specifications “apply to the following entities: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter”; and, “where provided”, to a business associate | RQ-01 to RQ-04 and the Decision Table: to whom the Rules apply |
| HIPAA — 45 CFR Parts 160 and 164 | § 160.103, “Covered entity” — a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. “Health plan” means “an individual or group plan that provides, or pays the cost of, medical care”. A “health care clearinghouse” processes health information received in a nonstandard format into standard data elements or a standard transaction, or the reverse. A health care provider is anyone who “furnishes, bills, or is paid for health care in the normal course of business”. “Transaction” is the transmission of information between two parties to carry out financial or administrative activities related to health care, and the definition lists the types: claims or encounter information, payment and remittance advice, coordination of benefits, claim status, enrollment and disenrollment, eligibility, premium payments, referral certification and authorization, first report of injury, claims attachments and electronic funds transfers | RQ-01 to RQ-04, rows CE-1 to CE-3: health plan, clearinghouse and provider |
| HIPAA — 45 CFR Parts 160 and 164 | § 160.103, “Business associate” — a person who, “on behalf of” a covered entity and “other than in the capacity of a member of the workforce”, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter”, or who provides listed services (legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial) where the service involves disclosure of protected health information to the person. A covered entity may be a business associate of another covered entity. The definition includes data transmission services with routine access, a personal health record offered on behalf of a covered entity, and “A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate”. Four exceptions are listed: disclosures to a provider for treatment, a plan sponsor, a government agency determining eligibility, and a covered entity in an organized health care arrangement | RQ-05 to RQ-09, rows BA-1 to BA-4 and SC-1 to SC-3: business associates, subcontractors and the four exceptions |
| HIPAA — 45 CFR Parts 160 and 164 | § 160.103 — “Protected health information” is individually identifiable health information that is transmitted or maintained in any form or medium, with four exclusions (education records, certain student records, employment records held as employer, and a person deceased for more than 50 years). “Electronic protected health information” is that information when it is “transmitted by electronic media” or “maintained in electronic media”. The Security Rule applies to the electronic form only (§ 164.302, § 164.306(a)) | The Definitions sheet: what protected health information is |
| HIPAA — 45 CFR Parts 160 and 164 | § 160.103 — “Workforce” means employees, volunteers, trainees and other persons whose conduct, in the performance of work for a covered entity or business associate, is under its direct control, whether or not they are paid by it. A “subcontractor” is “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate” | RQ-05 and RQ-08: staff are not business associates; the subcontractor definition |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.103 and § 164.105 — a “hybrid entity” is a single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates health care components. If a covered entity is a hybrid entity, the Security Rule and most of the rest of Part 164 apply “only to the health care component(s) of the entity”, but § 164.314 and § 164.504 (business associate arrangements) apply to the whole entity. The designation is documented and kept for six years (§ 164.105(c)) | RQ-10, RQ-11, rows HY-1 to HY-5: hybrid entities and the written designation |
| HHS Office for Civil Rights guidance | “Business Associates” (content last reviewed 30 July 2026): a business associate is “directly liable” for complying with certain provisions of the HIPAA Rules, and a subcontractor that creates, receives, maintains or transmits protected health information on behalf of a business associate is also a business associate. The page lists examples, among them a cloud service provider engaged to create, receive, maintain or transmit electronic protected health information, an IT contractor with access to it, and a third party administrator; and lists situations in which no business associate agreement is required (treatment disclosures to a provider, a person whose access is only incidental, a conduit that only transmits). A business associate must have a business associate agreement with its subcontractor before disclosing protected health information to it | RQ-05 to RQ-09 and HR-01: HHS's explanation of who a business associate is |
| HHS Office for Civil Rights guidance | Preamble to the Omnibus Rule, 78 FR 5566 (25 January 2013), on who is a business associate (the passage at 78 FR 5571 to 5572 was read): “The conduit exception is a narrow one”, “intended to exclude only those entities providing mere courier services”, and a conduit “does not access it other than on a random or infrequent basis as necessary to perform the transportation service or as required by other law”. The exception “is limited to transmission services (whether digital or hard copy), including any temporary storage of transmitted data incident to such transmission”; “an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information”. The preamble is interpretation, not the text of the Rule. The rest of the preamble was not read | RQ-05 and RQ-09: the narrow conduit exception, and why storing protected health information is never a conduit |
| HITECH Act, as codified in 42 U.S.C. | 42 U.S.C. 17931 (HITECH Act section 13401) — “Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity”, and the additional security requirements of the HITECH title are incorporated into the business associate agreement | The What It Means sheet: direct application of the Security Rule to a business associate |
Editions referenced: 45 CFR Parts 160 and 164 as the eCFR prints them (current to 6 October 2026); HITECH Act provisions at 42 U.S.C. 17931, 17934 and 17941; HHS Office for Civil Rights guidance on risk analysis, business associates and unsecured protected health information; NIST SP 800-66 Rev. 2 (informative); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); as published and read on 18 October 2026
A reference says what its source asks, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement, and it does not say that an organisation is compliant or certified. The Rules provide no certificate of compliance for an organisation to hold.
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of the HIPAA Rules, or that your organisation holds a certificate.
The HIPAA Rules in 45 CFR Parts 160 and 164 apply to covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions) and, where the Rules provide, to business associates and their subcontractors. Whether your organisation is one of them is decided by what it does with protected health information, and counsel confirms it. The Security Rule (Subpart C) protects electronic protected health information. The Breach Notification Rule (Subpart D) applies to breaches of unsecured protected health information. This pack does not decide which applies to you.
The HHS guidance and the NIST publication cited here are not law. HHS says its risk analysis guidance is not a blueprint and that no method guarantees compliance. NIST SP 800-66 Rev. 2 is an informative resource. Using either is not a statement that your organisation is compliant or certified.