Covered Entity
What is Covered Entity?
Under HIPAA, a health plan, healthcare clearinghouse, or healthcare provider that transmits any health information electronically. Covered entities must comply with all HIPAA Administrative Simplification rules.
Terms that appear alongside covered entity
Each of these is named in at least one of the same controls as covered entity. The number is how many controls name both.
- business associate 12 shared controls
- hipaa 11 shared controls
- cisa 9 shared controls
- cyber incident 8 shared controls
- breach notification 7 shared controls
- compliance 6 shared controls
- ransomware 6 shared controls
- nist 5 shared controls
Frameworks that govern covered entity
What the standards actually require on covered entity
Requirements naming covered entity across 6 standards, quoted from the control text.
A business associate that holds, uses or discloses unsecured protected health information must, following discovery of a breach, notify the covered entity and identify each individual whose information has been or is reasonably believed to have been accessed,...
hitech-act::13402b · Section 13402(b): a business associate notifies the covered entity of a breach and identifies each affected individual →Defines the operative scope: a covered entity is an entity in a critical infrastructure sector (PPD-21) meeting the criteria set by the CISA final rule;
CIRCIA-2240 · Definitions: Covered Entity, Covered Cyber Incident, Ransom Payment →A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, identifying to the extent possible each individual whose unsecured PHI was breached and providing the information the covered...
hipaa-breach-notification-rule::164.410 · Business associate notification to the covered entity →A covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires, or as the individual (or personal representative) authorizes in writing.
hipaa-privacy-rule::164.502a · General rule: PHI may be used or disclosed only as the Privacy Rule permits or requires, or with written authorization →On request, the covered entity provides the Board with specific information regarding the cybersecurity incident.
nevada-gaming-control-board-cybersecurity-requirements::5.260(4)(d) · 5.260(4)(d) Specific information about the incident on the Board's request →When a covered entity and its business associate are both governmental entities, the requirements may be met through an MOU or other law that accomplishes the objectives of paragraph (a)(2)(i).
164.314(a)(2)(ii) · Other Arrangements (Government) →Questions people ask about covered entity
What is Covered Entity?
Why is Covered Entity important for compliance?
Which compliance frameworks address Covered Entity?
Where can I learn more about Covered Entity?
See how Covered Entity applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.