Is every healthcare business a HIPAA covered entity?
No. HHS defines a provider as a covered entity when it conducts specified standard electronic transactions. A company may instead be a business associate when its work for a covered entity involves protected health information.[1]
Map which entity collects, receives, stores, or sends the information and what services it performs for customers. HHS guidance says cloud providers maintaining electronic protected health information for a covered entity or business associate can have business-associate duties, including when the information is encrypted.[1]
Use that map to answer the insurance application and customer security questions. Confirm your legal status with counsel, then ask the broker which proposed terms address your data, vendors, and incident duties.[1][4]
Read the Healthcare Insurance Buying Guide
Sources and Further Reading
- Guidance on HIPAA & Cloud Computing — U.S. Department of Health and Human Services, Office for Civil Rights. Questions 1–3 on covered entities, business associates, cloud service providers, BAAs, and risk analysis; Question 7 on mobile device access to cloud ePHI
Check covered-entity and business-associate roles when your product handles electronic protected health information for a customer.
- Medical Malpractice Insurance — National Association of Insurance Commissioners. Background: scope of medical professional liability and claims-made and occurrence forms
- Small Business Insurance — National Association of Insurance Commissioners. Business owners policy, general liability, general-liability exclusions, and other business liability sections
Compare general liability with professional, employee, and vehicle exposures using NAIC’s general buyer guide.
- Cybersecurity — National Association of Insurance Commissioners, Center for Insurance Policy and Research. Cyber loss categories and qualification that most commercial property and general liability policies do not cover cyber risks and cyber policies are customized
- Cyber Insurance: Cybersecurity for Small Business — National Association of Insurance Commissioners. First-party and third-party coverage sections; vendor-held data and defense wording prompts
- Commercial Insurance Guide — California Department of Insurance. Purchasing insurance; commercial property; commercial general liability; workers compensation
Review California guidance on property, liability, and business locations; check rules in each state where you operate.
- Employer Information — California Department of Industrial Relations, Division of Workers’ Compensation. California employer insurance requirement and out-of-state employer note
Spot, a product of Tools for Enlightenment, publishes this guide and works in the commercial insurance market. This is general buyer education; policy terms and state-specific obligations determine coverage and requirements.
Updated 2026-09-28. Editorial Policy
Get Help With Insurance Buying and Renewals.
Get help buying coverage and managing renewals, with less paperwork for your team. Start with a free consultation.
