Covered Entities Under HIPAA: HHS OCR vs Business Associate Rules for Understanding HIPAA Coverage
HIPAA coverage starts with role, transaction type, and access to protected health information. HHS OCR does not treat every health-related company as a covered entity, and a business associate agreement does not magically turn a vendor into one. The key question is simple: Are you a covered entity, a business associate, a subcontractor, or outside HIPAA entirely? Getting that wrong can mean weak contracts, missed breach duties, and civil penalties.