The Health Insurance Portability and Accountability Act (HIPAA) establishes health-information obligations based on the organization's role and the information involved. Possessing health-related information alone does not establish that every holder is a covered entity.
The covered-entity categories have distinct functions.
- Health plans provide or pay for medical care, including qualifying insurers and employer-sponsored group plans.
- Health care clearinghouses convert nonstandard health information into standard transaction formats, or perform the reverse conversion.
- Health care providers are covered when they transmit health information electronically in connection with covered transactions, including through a billing intermediary.
A business associate performs services involving protected health information for a covered entity, outside that entity's workforce. A medical-billing contractor ordinarily qualifies; an independent specialist receiving information solely to treat a patient does not become a business associate merely through that disclosure.
HIPAA privacy rules distinguish contractual duties from entity classification.
- Business-associate agreements establish permitted handling and required protections; they cannot grant permission for a disclosure the covered entity could not lawfully make.
- The Health Information Technology for Economic and Clinical Health Act (HITECH) extends direct security and specified privacy duties to business associates and strengthens enforcement and breach-notification obligations.
Common mistakes
- Health data overgeneralized. A wellness service holding health-related information does not automatically satisfy the covered-entity or business-associate tests.
- Limited data mistaken for anonymity. A HIPAA limited data set remains PHI, and pseudonymized GDPR data remain personal when reidentification is reasonably possible.
- Encryption treated as retention permission. Encrypted merchant archives of verification values remain prohibited after authorization.
Bottom line
- HIPAA distinguishes covered entities and business associates, protects PHI through the Privacy Rule, and protects ePHI through the Security Rule.
- GDPR scope depends on covered processing relationships; its six processing principles operate alongside accountability, lawful bases, and individual rights.
- PCI DSS organizes twelve requirement families under six goals and prohibits merchants from retaining sensitive authentication data after authorization.
- The CSF comprises Core, Tiers, and Organizational Profiles, with six concurrent Core functions including Govern.
Exam shortcut
The actor, information, purpose, and governing relationship determine the applicable law or framework. A professional title or encrypted channel cannot supply missing disclosure permission. Each recipient requires separate GDPR transfer analysis. Binding Corporate Rules are only ever an option inside the corporate group, so a stem naming a third-party vendor rules them out.
The full lesson (about 9,738 words, 65 min read) adds 3 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.A1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.