Who Is a HIPAA Covered Entity?
HIPAA covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. Employers are not covered entities — but their health plans are. For self-funded plans, the plan itself is the covered entity, and the employer acts as the plan sponsor.
| Entity | HIPAA Covered Entity? | Notes |
|---|---|---|
| Self-funded health plan | Yes | The plan is the covered entity; employer is plan sponsor |
| Fully insured health plan | Yes (through insurer) | The insurance company is the covered entity |
| Employer (as employer) | No | Employers are not covered entities in their employment capacity |
| TPA for self-funded plan | Business associate | TPAs are business associates, not covered entities |
The Plan Sponsor/Covered Entity Firewall
HIPAA creates a firewall between the health plan (covered entity) and the employer (plan sponsor). The employer cannot use PHI obtained from the health plan for employment purposes — hiring, firing, promotions, or other employment decisions. The plan document must include provisions restricting the employer's use of PHI.
Watch Out
HR staff who administer the health plan have access to PHI in their plan administration role. They cannot use that information in their employment role. An HR manager who learns that an employee has a serious illness through claims data cannot use that information in a performance review or termination decision. The firewall must be maintained in practice, not just on paper.
What Is PHI?
Protected Health Information (PHI) is individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. PHI includes any information that relates to an individual's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare — if it can be used to identify the individual.