Who qualifies as a covered entity under HIPAA?

Who qualifies as a covered entity under HIPAA?

• A. A patient.
• B. A health plan, a healthcare clearinghouse, or a healthcare provider that transmits PHI electronically.
• C. Only hospitals.
• D. A business that handles medical records.

Answer: (B)

The main idea is understanding who HIPAA considers a covered entity. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who electronically transmit PHI in covered transactions. This definition focuses on organizations that actually handle or move protected health information in standardized electronic forms, so they must follow HIPAA privacy and security rules. That’s why the correct choice is the best: it names the three categories that HIPAA covers. A patient is not a covered entity—the patient is the subject of PHI, not the entity that must comply. A hospital alone would be too narrow, since many other providers can be covered if they transmit PHI electronically in the required transactions. A business that handles medical records is usually a business associate, not a covered entity, though they must adhere to HIPAA requirements through contracts with a covered entity.

The main idea is understanding who HIPAA considers a covered entity. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who electronically transmit PHI in covered transactions. This definition focuses on organizations that actually handle or move protected health information in standardized electronic forms, so they must follow HIPAA privacy and security rules.

That’s why the correct choice is the best: it names the three categories that HIPAA covers. A patient is not a covered entity—the patient is the subject of PHI, not the entity that must comply. A hospital alone would be too narrow, since many other providers can be covered if they transmit PHI electronically in the required transactions. A business that handles medical records is usually a business associate, not a covered entity, though they must adhere to HIPAA requirements through contracts with a covered entity.