Generally, when you hear about HIPAA the discussion is associated with a hospital or a medical group that had a breach or HIPAA violation. What most people don’t know is that HIPAA applies to organizations outside of hospitals and health networks. So who exactly needs to be compliant when it comes to HIPAA?
It can be somewhat vague when you start looking at HIPAA. The US Department of Human Health Services describes those who must be compliant are called “covered entities.” Let’s dig a little deeper and understand what types of organizations are considered to be a covered entity.
Health Plans – Anyone who deals with insurance or medical information for patients.
- HMOs
- Medicare
- Medicaid
- Human resource employees/employers and schools who handle patient information when the employees are hired and students are enrolled.
- Billing/Collection Services
- Health Management Information Systems
- Physicians
- Surgeons
- Dentists
- Optometrists
- Hospitals
- Clinics
- Nursing Homes/Care Facilities
- Pharmacies
- Data Processors
- Medical Equipment Companies
- Consultants
- Medical Transcription Services
- External Accountants and Auditors
- Any third party organization dealing with PHI.
- Any conversation with medical professionals about a patient’s care or treatments
- Any patient billing information
- Any medical insurance information