Which regulation defines a covered entity?

45 CFR 160.103 defines a covered entity. The same section defines a health plan, a health care clearinghouse, and a health care provider, so the three categories can be checked against one text. A practice falls under the provider category only if it conducts standard transactions electronically.

Why does covered entity status matter for a small practice?

A small practice meets the same test as a large one, because the definition names no size. A solo practice that conducts standard transactions electronically is covered under the provider category. Covered entity status is the starting point for whether HIPAA's privacy rules reach the practice's patient records.

How does covered entity status apply to faxing?

Faxing alone does not decide covered entity status. The question is whether the practice conducts standard transactions electronically. A fax of records is not, by itself, one of those transactions, so the practice's other electronic transactions decide the question. The provider test in 45 CFR 160.103 turns on that question.

October 16, 2026

What is a covered entity under HIPAA?

A covered entity is a health plan, a health care clearinghouse, or a health care provider that conducts standard transactions electronically, under 45 CFR 160.103.

An old desktop fax machine with a handset and a coiled cord on a white desk

A covered entity is a health plan, a health care clearinghouse, or a health care provider that conducts standard transactions electronically. The definition is in 45 CFR 160.103. Only a provider has to meet the electronic test, so a practice qualifies when it conducts standard transactions electronically.

Which organizations count as covered entities?

A covered entity is one of three kinds of organization: a health plan, a health care clearinghouse, or a health care provider. A health plan is an individual or group plan that provides, or pays the cost of, medical care.

A health care clearinghouse is a public or private entity, such as a billing service, repricing company, or value-added network, that performs one of two listed functions on health information. A health care provider includes a provider of services and a provider of medical or health services, as those terms are defined in sections 1861(u) and 1861(s) of the Social Security Act.

When does a provider count as a covered entity?

A provider is a covered entity when it transmits health information electronically in connection with a transaction covered by HIPAA. The rule describes a provider who "transmits any health information in electronic form in connection with a transaction covered by this subchapter."

Health plans and clearinghouses are covered without that test.

What does covered entity status mean for a small practice?

Covered entity status uses the same test for a solo office as for a hospital, because the definition sets no minimum size. Two practices of similar size can still land on opposite sides of the line. The deciding factor is which transactions each one sends electronically.

Does faxing make a practice a covered entity?

Sending a fax does not, by itself, make a practice a covered entity. The rule's test is about standard transactions. A practice's billing and other electronic exchanges therefore settle the question.

For whether faxing meets HIPAA's rules, see whether faxing is HIPAA compliant. For the business associate side, see whether a fax service needs a BAA.

Which terms get confused with covered entity?

Three terms in the same definitions are easy to confuse with covered entity.

Health plan: the first of the three categories above.
Health care clearinghouse: the second of the three categories above.
Business associate: a person who, on behalf of a covered entity and outside its own workforce, creates, receives, maintains, or transmits protected health information. Business associates are a separate category under the same section.

* Fax Pigeon prices and plan terms as of October 16, 2026.

Frequently asked questions

What is a covered entity under HIPAA?: A covered entity is a health plan, a health care clearinghouse, or a health care provider that conducts standard transactions electronically. Health plans and clearinghouses are covered on their own. A provider is covered only when it conducts those transactions electronically. The definition is in 45 CFR 160.103.
Which regulation defines a covered entity?: 45 CFR 160.103 defines a covered entity. The same section defines a health plan, a health care clearinghouse, and a health care provider, so the three categories can be checked against one text. A practice falls under the provider category only if it conducts standard transactions electronically.
Why does covered entity status matter for a small practice?: A small practice meets the same test as a large one, because the definition names no size. A solo practice that conducts standard transactions electronically is covered under the provider category. Covered entity status is the starting point for whether HIPAA's privacy rules reach the practice's patient records.
How does covered entity status apply to faxing?: Faxing alone does not decide covered entity status. The question is whether the practice conducts standard transactions electronically. A fax of records is not, by itself, one of those transactions, so the practice's other electronic transactions decide the question. The provider test in 45 CFR 160.103 turns on that question.

Fax Pigeon

HIPAA-compliant fax with a signed BAA on every plan

Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.

Free porting of your local number
Fax from your email
AI summary of every inbound fax
E-signatures
Contact management
Delivery proof

Plans and pricing

Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.