Definition
A covered entity is an organization that handles protected health information (PHI) and is subject to specific regulations like HIPAA. These entities include healthcare providers, health plans, and healthcare clearinghouses. They must implement robust security measures to safeguard the privacy and integrity of PHI. In practice, this means establishing policies for data access, storage, transmission, and disposal. Understanding covered entity status is crucial for compliance, avoiding severe penalties, and maintaining patient trust. For instance, a hospital's billing department processing patient records falls under this designation. It is distinct from a business associate, which is a third party performing functions for a covered entity that involve PHI. This concept is fundamental to the CISSP and CCSP certifications.