Last verified: October 2026, against 45 CFR 160.103, CMS's covered entity guidance and the FTC. General information, not legal advice — confirm with your compliance officer or attorney.
Who does HIPAA apply to? Three kinds of covered entities (health plans, health care clearinghouses and health care providers that conduct certain transactions electronically) plus the business associates that handle patient information for them. For a practice, the deciding question is usually whether you, or a billing service acting for you, send insurance-type transactions electronically. "Hipaa covered entity" is searched about 2,900 times a month and "who does hipaa apply to" 1,300 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
In short: HIPAA applies to health plans, clearinghouses and providers that send standard transactions such as claims or eligibility checks electronically, and to their business associates. Once a practice qualifies, HIPAA covers all of its patient information, cash-pay patients included. Practices that never send those transactions may fall outside HIPAA, but not outside privacy law.
The short answer: covered entities and business associates
HIPAA regulates two groups. Covered entities hold the primary obligations under the Privacy, Security and Breach Notification Rules. Business associates, the vendors that create, receive, maintain or transmit protected health information on a covered entity's behalf, must follow the Security Rule and their contracts, and can be penalized directly for their own violations under 45 CFR 160.402 (opens in a new tab).
Everyone else, from a fitness app to a supplement shop, is outside HIPAA even when it holds health data. Whether information counts as protected depends on who holds it; our hub on what is PHI explains the three tests.
The three kinds of covered entities
45 CFR 160.103 (opens in a new tab) defines a covered entity as:
- A health plan: insurers, HMOs, employer group health plans, Medicare and Medicaid, among others.
- A health care clearinghouse: a company, including a billing service, that converts health information between nonstandard formats and HIPAA's standard transactions.
- A health care provider "who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
The provider definition is broad: "any other person or organization who furnishes, bills, or is paid for health care in the normal course of business." Doctors, dentists, therapists, chiropractors and nurse practitioners are all providers. What makes a provider a covered entity is the electronic transaction, not the license.
The provider test: electronic standard transactions
A "transaction" under 160.103 is a transmission "to carry out financial or administrative activities related to health care." The list includes health care claims, payment and remittance advice, coordination of benefits, claim status, enrollment, eligibility for a health plan, premium payments, referral certification and authorization, first report of injury, claims attachments and electronic funds transfers.
In plain terms, if your practice electronically submits a claim, checks a patient's eligibility or requests a prior authorization, you are almost certainly covered. CMS's covered entity page (opens in a new tab) says, "Providers who submit HIPAA transactions, like claims, electronically are covered." Its decision tool (opens in a new tab) asks two questions: do you furnish, bill or get paid for health care in the normal course of business, and do you transmit any covered transactions electronically? It adds a point that catches many practices: if a provider uses another entity, such as a clearinghouse, to conduct covered transactions electronically on its behalf, the provider "is considered to be conducting the transaction in electronic form."
Once you are covered, HIPAA isn't limited to insurance patients or electronic files. When HHS finalized the Privacy Rule in 2000, it extended protection (opens in a new tab) "to all individually identifiable health information in any form, electronic or non-electronic, that is held or transmitted by a covered entity." The rule even gives self-pay patients an extra right: under 164.522(a)(1)(vi) (opens in a new tab), a patient who pays in full out of pocket can require you not to disclose that service to their health plan.
Cash-pay practices, med spas and concierge models
This is where the honest answer is "check your billing, not your business model."
- Truly cash-only practices. A provider that never sends a standard transaction electronically, directly or through a billing company, may not be a covered entity. Handing a patient a paper superbill to file on their own is not, on its face, the practice transmitting a claim, but have counsel confirm how your workflow fits.
- Med spas. Medical services such as injectables or laser treatments are health care, delivered by licensed providers. If the spa ever bills insurance electronically, for example for a dermatology consult, it is a covered entity, and HIPAA then reaches all of its patient information. See med spa marketing for the advertising side.
- Concierge and direct-care practices. A membership fee doesn't change the test. Many concierge practices still bill insurance for visits or labs, or check eligibility, which makes them covered. Our guide to concierge medicine marketing covers positioning.
Two practical cautions. Your status can change quietly, the first time a front-desk hire runs an electronic eligibility check. And many patients, vendors and payment processors will assume you follow HIPAA, so contracts and patient expectations often pull cash-pay practices into HIPAA-level practices anyway.
Business associates: the vendors HIPAA reaches
Under 160.103, a business associate is a person or company that, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information," or provides services such as legal, accounting, consulting, management or data aggregation that involve PHI. Subcontractors of business associates count too.
For a practice, that typically means the billing company, the IT managed service provider, the EHR and practice-management vendor, the website host that stores form submissions, the CRM and chat tool, and any marketing agency that handles leads. The regulation excludes a provider receiving PHI for treatment, so a specialist you refer to isn't your business associate. Our guide to what a business associate is walks through the edge cases.
Medfy signs a BAA with every practice before any patient data flows, and stores patient information from its forms, chat, inbox and CRM in separate, encrypted HIPAA databases in the US or Canada. That setup is relevant whether or not your practice is a covered entity, because the safeguards protect patients either way. Details are in how Medfy handles patient data.
Rules that apply even if HIPAA doesn't
Falling outside HIPAA doesn't mean anything goes.
- The FTC Act. The FTC states (opens in a new tab) that its ban on unfair or deceptive practices applies to companies that collect, use or share health information but aren't required to comply with HIPAA, and to covered entities as well. A privacy promise on your website that your tracking setup doesn't keep is the kind of gap a deception claim is built on.
- The FTC Health Breach Notification Rule. It covers vendors of personal health records and related entities, and 16 CFR 318.1 (opens in a new tab) says it "does not apply to HIPAA-covered entities," or to entities acting as their business associates.
- State law. Many states have their own health-privacy, consumer-privacy and breach-notification laws, and some apply regardless of HIPAA status. Check your state's rules with counsel.
Canadian clinics follow PIPEDA (opens in a new tab) or provincial privacy laws instead of HIPAA; see HIPAA in Canada. Once you know HIPAA applies, the next step is understanding what HIPAA compliance means in day-to-day terms. A free marketing audit is a quick way to see whether your website shares patient data with ad platforms, covered entity or not.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does HIPAA apply to cash-only practices?
Only if the practice, or a billing service acting for it, sends any HIPAA standard transaction electronically, such as a claim, an eligibility check or a referral authorization. A truly cash-only practice that never does may not be a covered entity. State health-privacy laws and the FTC Act still apply, and patients expect HIPAA-level care either way. Confirm your status with your compliance officer or attorney.
Are med spas covered by HIPAA?
It depends on billing, not on the services. A med spa whose medical providers never send claims, eligibility checks or other standard transactions electronically may fall outside HIPAA. One that bills insurance electronically for any service, even occasionally, is a covered entity for all of its patient information. Either way, state privacy and consumer-protection laws apply. Confirm your med spa's status with your compliance officer or attorney.
Is a marketing agency covered by HIPAA?
Yes, as a business associate, if it creates, receives, maintains or transmits PHI for a covered practice, for example by handling form leads, patient email lists or call data. It must sign a business associate agreement and is directly liable for its own HIPAA violations. An agency that only ever sees aggregate, de-identified reports isn't handling PHI. Confirm your arrangement with your compliance officer or attorney.
Does HIPAA apply to Canadian clinics?
No. HIPAA is a US federal law covering US covered entities and their business associates. Canadian clinics answer to the federal PIPEDA or to provincial privacy laws, and four provinces have health-information laws the federal privacy commissioner treats as substantially similar. A Canadian vendor that handles PHI for a US practice can still be a business associate. Confirm the rules for your province with a qualified advisor.