--- title: "Is every healthcare business a HIPAA covered entity?" description: "No. HHS defines a provider as a covered entity when it conducts specified standard electronic transactions. A company may instead be a business associate when its work for a covered entity involves protected health information." canonical: "https://spot.insure/industries/healthcare/is-every-healthcare-startup-hipaa-covered" page-type: "industry-faq" updated-at: "2026-09-28" --- Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, compare_providers for sourced comparisons, get_provider_score for a published Spot Score, get_rankings for current provider rankings, search_provider_reliability to filter Spot Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication. [Human-readable page](https://spot.insure/industries/healthcare/is-every-healthcare-startup-hipaa-covered) # Is every healthcare business a HIPAA covered entity? No. HHS defines a provider as a covered entity when it conducts specified standard electronic transactions. A company may instead be a business associate when its work for a covered entity involves protected health information. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) Map which entity collects, receives, stores, or sends the information and what services it performs for customers. HHS guidance says cloud providers maintaining electronic protected health information for a covered entity or business associate can have business-associate duties, including when the information is encrypted. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) Use that map to answer the insurance application and customer security questions. Confirm your legal status with counsel, then ask the broker which proposed terms address your data, vendors, and incident duties. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html), [Cybersecurity](https://content.naic.org/cipr_topics/topic_cybersecurity.htm) ## Need Help Choosing Coverage? Spot prepares your applications, coordinates with brokers, and helps you compare quotes so you can choose coverage with the key details in front of you. [Book a Free Consultation](https://cal.com/team/spotinsure/insurance-consultation) [Read the Healthcare Insurance Buying Guide](https://spot.insure/industries/healthcare) ## More Healthcare Questions - [What should I send before asking for a healthcare insurance quote?](https://spot.insure/industries/healthcare/what-to-send-before-first-quote) ## Coverage to Discuss - [Medical malpractice](https://spot.insure/coverage/medical-malpractice) - [Cyber liability](https://spot.insure/coverage/cyber) - [General liability](https://spot.insure/coverage/general-liability) - [Commercial property](https://spot.insure/coverage/commercial-property) - [Workers’ compensation](https://spot.insure/coverage/workers-compensation) ## Sources and Further Reading - [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) — U.S. Department of Health and Human Services, Office for Civil Rights. Questions 1–3 on covered entities, business associates, cloud service providers, BAAs, and risk analysis; Question 7 on mobile device access to cloud ePHI Check covered-entity and business-associate roles when your product handles electronic protected health information for a customer. - [Medical Malpractice Insurance](https://content.naic.org/insurance-topics/medical-malpractice-insurance) — National Association of Insurance Commissioners. Background: scope of medical professional liability and claims-made and occurrence forms - [Small Business Insurance](https://content.naic.org/consumer/small-business.htm) — National Association of Insurance Commissioners. Business owners policy, general liability, general-liability exclusions, and other business liability sections Compare general liability with professional, employee, and vehicle exposures using NAIC’s general buyer guide. - [Cybersecurity](https://content.naic.org/cipr_topics/topic_cybersecurity.htm) — National Association of Insurance Commissioners, Center for Insurance Policy and Research. Cyber loss categories and qualification that most commercial property and general liability policies do not cover cyber risks and cyber policies are customized - [Cyber Insurance: Cybersecurity for Small Business](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf) — National Association of Insurance Commissioners. First-party and third-party coverage sections; vendor-held data and defense wording prompts - [Commercial Insurance Guide](https://www.insurance.ca.gov/01-consumers/105-type/95-guides/09-comm/commercialguide.cfm) — California Department of Insurance. Purchasing insurance; commercial property; commercial general liability; workers compensation Review California guidance on property, liability, and business locations; check rules in each state where you operate. - [Employer Information](https://www.dir.ca.gov/dwc/employer.htm) — California Department of Industrial Relations, Division of Workers’ Compensation. California employer insurance requirement and out-of-state employer note Spot, a product of Tools for Enlightenment, publishes this guide and works in the commercial insurance market. This is general buyer education; policy terms and state-specific obligations determine coverage and requirements. Updated 2026-09-28. [Editorial Policy](https://spot.insure/editorial-policy). ## Agent and Developer Resources - [Markdown page](https://spot.insure/industries/healthcare/is-every-healthcare-startup-hipaa-covered.md) - [Developer resources](https://spot.insure/developers) - [Public MCP server](https://spot.insure/mcp) - [MCP server manifest](https://spot.insure/server.json) - [OpenAPI description](https://spot.insure/openapi.json) - [Public page index](https://spot.insure/llms.txt)