---
title: "What Is a HIPAA Covered Entity? Definition and Examples"
description: "A HIPAA covered entity is a health plan, clearinghouse or provider that runs standard transactions electronically. Who it is in telehealth, and Cuvo's role."
canonical: "https://cuvo.co/glossary/covered-entity"
last-updated: "Oct 26, 2026"
---
**Definition:** Under HIPAA, a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction, such as a claim or an eligibility inquiry (45 CFR 160.103).

# What is a covered entity under HIPAA?

HIPAA does not apply to everyone who handles health information. It applies to covered entities and the business associates that work for them, and the test for a provider turns on how it transacts, not what it treats. Cuvo Health signs a business associate agreement on every plan for the clinical layer it runs.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

Under HIPAA, a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction, such as a claim, a payment or an eligibility inquiry to a health plan (45 CFR 160.103). HIPAA's privacy and security rules are written for covered entities and their business associates, the vendors that create, receive, maintain or transmit protected health information on their behalf under a written agreement. In a white-label telehealth model the covered entity, where there is one, is the licensed practice that treats the patient, not the consumer brand. On Cuvo Health, a physician-owned professional entity holds the clinical practice, and Cuvo signs a business associate agreement on every plan.

**At a glance**
- What it is: A health plan, a clearinghouse, or a provider that conducts HIPAA standard transactions electronically
- Defined in: 45 CFR 160.103
- Trigger for a provider: Transmitting health information electronically in any standard transaction, such as a claim
- Its vendors: Business associates, bound by a written agreement under 45 CFR 164.502(e)
- On Cuvo: A physician-owned professional entity holds the practice; Cuvo signs a BAA on every plan

**The three kinds of covered entity, and where a telehealth brand fits**

| Who | Examples in 45 CFR 160.103 | In a telehealth brand |
| --- | --- | --- |
| **Health plan** | Group health plans, health insurance issuers, HMOs, Medicare Parts A and B, Medicaid | Pays claims; sits outside a cash-pay brand's own stack |
| **Health care clearinghouse** | Billing services, repricing companies and networks that convert health information to or from standard formats | Only where the practice bills insurance through one |
| **Covered health care provider** | Any provider that furnishes, bills or is paid for care and transmits a standard transaction electronically | The licensed practice that treats the brand's patients, when it conducts standard transactions |
| **Not a covered entity** | A business that neither provides care nor handles PHI for a covered entity | The consumer brand's storefront and marketing, reached instead by FTC and state health data rules |

## 01. Is a telehealth brand a covered entity?

Usually the brand itself is not. The brand sells the program, runs the storefront and markets it; the licensed practice provides the care. When that practice conducts standard transactions electronically it is the covered entity, and the platform that handles protected health information for it is a business associate. The brand's consumer-facing surfaces can still fall under the FTC Health Breach Notification Rule and state consumer health data laws such as Washington's My Health My Data Act. On Cuvo, the clinical layer runs on HIPAA-compliant infrastructure under a business associate agreement on every plan.

## 02. Is a cash-pay telehealth practice a covered entity?

The answer depends on transactions, not on insurance alone. The 160.103 definition reaches a provider that transmits health information electronically in connection with a transaction HIPAA covers, a list that includes claims, payment and remittance, eligibility inquiries and referral authorizations. A practice that conducts any of them electronically is a covered entity; one that conducts none may fall outside the definition, though the FTC and state law still apply. Whether a particular practice is covered is a question for its counsel.

## 03. How is a covered entity different from a business associate?

The covered entity holds the obligations to the patient: the right of access under 45 CFR 164.524, for example, runs against it. A business associate performs a function for the covered entity that involves protected health information, signs an agreement that sets what it may do with that data, and must comply with the Security Rule for electronic protected health information under 164.504(e)(2)(ii)(B). One company can be both: 160.103 says a covered entity may be the business associate of another covered entity.

**Primary sources**
- [45 CFR 160.103: covered entity, health plan, clearinghouse, provider, transaction](https://www.ecfr.gov/current/title-45/section-160.103): eCFR, checked Oct 26, 2026
- [45 CFR 164.502(e): disclosures to business associates](https://www.ecfr.gov/current/title-45/section-164.502): Written assurance from each business associate
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): Security Rule compliance by business associates

## Frequently asked questions

**Q: What is a covered entity under HIPAA?**

A: A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction, as defined in 45 CFR 160.103. On Cuvo, the physician-owned professional entity holds the clinical practice and Cuvo signs a business associate agreement on every plan.

**Q: Is a telehealth company a covered entity?**

A: The licensed practice that treats patients is a covered entity when it conducts standard transactions electronically; the consumer brand that markets the program usually is not. On Cuvo, the clinical layer runs on HIPAA-compliant infrastructure under a business associate agreement signed on every plan.

**Q: Covered entity vs business associate**

A: A covered entity is the plan, clearinghouse or provider HIPAA regulates directly; a business associate handles protected health information on its behalf under a written agreement and must meet the Security Rule for electronic data. On Cuvo, Cuvo signs that business associate agreement on every plan.

**Q: Does HIPAA apply to a telehealth brand?**

A: HIPAA applies to the covered entity that provides care and to its business associates, so it reaches the brand where the brand handles protected health information for the practice. Cuvo Health keeps intake, charts and prescriptions on HIPAA-compliant infrastructure under a business associate agreement and maintains a documented FTC Health Breach Notification Rule process for the consumer-facing surfaces HIPAA does not reach.

**Q: Is a pharmacy a covered entity under HIPAA?**

A: 45 CFR 160.103 counts dispensing a drug under a prescription as health care, so a pharmacy is a health care provider and becomes a covered entity when it transmits standard transactions electronically, such as claims to a health plan. On Cuvo, prescriptions go to licensed partner pharmacies with cold-chain home delivery.

**Related pages**

- [Business associate agreement (BAA)](/glossary/business-associate-agreement): The contract between a covered entity and its vendors
- [Protected health information (PHI)](/glossary/protected-health-information): What a covered entity's records contain
- [Who owns the patients and data in white label telehealth](/blog/who-owns-the-patients-and-data-on-a-white-label-telehealth-platform): Covered entity, business associate and brand roles in one deal
- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): Who signs as covered entity in a white-label model
- [Cuvo compliance](/compliance): The structure Cuvo builds and maintains for every brand
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/covered-entity