What is a Covered Entity?
"Covered entities" are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) medical care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage. For example, hospitals, academic medical centers, physicians, and other medical care providers who electronically transmit claims transaction information directly or through an intermediary to a health plan are covered entities.
Covered entities can be institutions, organizations, or persons. Researchers are covered entities if they are also medical care providers who electronically transmit health information in connection with any transaction for which HHS has adopted a standard. For example, physicians who conduct clinical studies or administer experimental therapeutics to participants during the course of a study must comply with the Privacy Rule if they meet the HIPAA definition of a covered entity."[ Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule, NIH Publication Number 03-5388 (HIPAA Research)]
If a person is are not dealing with a covered entity, HIPAA does not apply, even for medical treatment. For example, if a person goes a physician who only takes cash payment and does not deal with any health plans or medical care clearinghouses, that physician is not bound by HIPAA. An alternative medicine provider who only deals in cash is unlikely to be covered by HIPAA. Internet medical information questionnaires and online doctors who write prescriptions for drugs like Viagra based on a WWW site questionnaire are probably not protected by HIPAA. In these cases, state law still applies, but it is a very limited protection in the Internet world.
Medical research may or may not be covered by HIPAA. If it is clinical research that is part of routine medical care, it is covered if the routine care is covered by insurance or if the hospital or clinic where the research is done also does care that is covered by insurance. In a clinical trial that is not part of treatment may not be covered, depending on whether the institution doing the research is covered by HIPAA. If the research is covered by HIPAA, it must meet the basic HIPAA requirements, with some special exceptions for research. If the research is not being done by a covered entity, it is not covered by HIPAA.