Resources
Covered entity or business associate?
A covered entity is an organization that provides healthcare directly and transmits health information electronically in connection with a covered transaction — a medical practice, a hospital, a health plan. A business associate is anyone who handles protected health information on a covered entity's behalf without providing care directly — a billing company, an IT vendor, a credentialing firm. Both are legally required to train their workforce on HIPAA. Which specific obligations apply depends on which one you are.
What makes an organization a covered entity?
It provides healthcare directly to patients and transmits health information electronically for billing, eligibility, or other covered transactions.
What makes an organization a business associate?
It performs a function or service involving protected health information on behalf of a covered entity — billing, credentialing, IT, or similar — without delivering care itself.
Can an organization be both?
Yes. A multi-specialty group can act as a covered entity for the care it delivers directly, and also sign business-associate agreements when it handles data for other organizations.
Which LaborGenie track applies?
Business associates typically start with the HIPAA (Business Associate) core track. Covered entities take the HIPAA — Covered Entity track, which adds the patient-rights and breach-notification obligations that sit specifically with the entity holding the record. See both on Tracks.