45 CFR § 160.103 Definitions: Covered Entities and Business Associates

The definitions in 45 CFR § 160.103 are the master glossary for HIPAA’s administrative simplification rules. They decide who has to comply, what data is protected, and how far those protections reach. Get a definition wrong and you can misjudge whether your organization is regulated at all, or whether a given data set falls inside or outside the privacy and security rules. The terms below do most of that work: covered entity, business associate, health information, individually identifiable health information, and protected health information.¹

Covered Entity

Section 160.103 defines a covered entity as one of three things: a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction.¹ Fit any of those and the privacy, security, and breach notification rules apply in full.

Health Plans

A health plan is any individual or group plan that provides or pays for the cost of medical care. The category is deliberately wide. It picks up group health plans, health insurance issuers, HMOs, Medicare Parts A through D, Medicaid, CHIP, TRICARE, the Veterans health care program, the Indian Health Service, and the Federal Employees Health Benefits Program. Long-term care insurers and state high-risk pools are in as well.¹ Government programs whose main purpose is something other than health care, or that primarily fund direct care through grants rather than paying claims, are excluded.

Health Care Clearinghouses

A clearinghouse is a public or private entity that converts health data between nonstandard and standard electronic formats. Billing services, repricing companies, and health information networks all sit here. They stand between providers and payers, translating data so systems built on different platforms can exchange claims and other transactions.¹

Health Care Providers

Not every provider is a covered entity. The trigger is electronic transmission. A provider becomes covered only when it transmits health information electronically in connection with a transaction HIPAA standardizes, such as claims and encounter data, eligibility inquiries, referral authorizations, or claim status requests.¹² A cash-only physician who never sends a claim electronically is, technically, not a covered entity. That scenario is rare in practice.

Business Associate

A business associate is a person or organization that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. Claims processors, billing companies, data analysts, IT vendors hosting electronic health records, and outside attorneys or accountants who need patient data to do their work all fit. The definition also expressly pulls in subcontractors: any downstream vendor that handles protected health information on behalf of a business associate is itself a business associate and carries the same obligations.¹

Accountability follows the data. A hospital hires a billing company, the billing company hires a cloud storage vendor, and each link in the chain must independently meet HIPAA’s privacy and security requirements. Distance from the covered entity is not a defense.

Before sharing protected health information with a business associate, a covered entity must obtain written assurances that the data will be safeguarded. Those assurances take the form of a business associate agreement, a contract that limits how the associate may use and disclose the data, requires appropriate safeguards, and obligates the associate to report unauthorized uses or breaches. A business associate that engages a subcontractor with access to protected health information must execute a similar downstream agreement.³ Operating without these agreements is itself a violation, even if nothing is ever breached.

Health Information

Health information is the broadest data category in the regulation. It covers any information, including genetic information, in any form or medium (spoken, written, or electronic) that was created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and that relates to a person’s past, present, or future health condition, receipt of health care, or payment for that care.¹

Oral information counts. A phone call between a doctor and an insurer about a patient’s diagnosis is health information even though nothing was written down. So is a voicemail from a pharmacy about a refill.

Genetic Information

Section 160.103 defines genetic information separately and folds it into health information. It includes a person’s own genetic test results, the genetic tests of family members, any manifestation of a disease in family members, and any request for or participation in genetic services or clinical research involving genetic services. It also covers genetic information about a fetus carried by a pregnant woman and about any embryo held through assisted reproductive technology.¹ Sex and age are excluded from the definition, and a disease already diagnosed in a person is treated as a medical condition rather than genetic information about that person.

Individually Identifiable Health Information

Individually identifiable health information is the narrower subset that matters for most compliance work. To qualify, information must be created or received by a provider, plan, employer, or clearinghouse; relate to a person’s health condition, care, or payment; and either identify the person or provide a reasonable basis to believe the person could be identified from it.¹

Names, birth dates, and Social Security numbers are the obvious identifiers. The “reasonable basis” language reaches further. A combination of a zip code, a diagnosis, and a treatment date can be enough to single out one person even without a name attached. Aggregate hospital statistics about flu admissions are health information, but they identify no one. The moment a data point links back to a specific patient, the regulatory intensity jumps.

Protected Health Information

Protected health information, or PHI, is the term that triggers HIPAA’s core privacy and security obligations. It is individually identifiable health information transmitted or maintained in any form: electronic, paper, or oral.¹ Most day-to-day compliance work revolves around this category because it carries the strictest rules about access, disclosure, and breach response.

What Is Not PHI

Section 160.103 carves out four categories from protected health information, even when the data would otherwise qualify:

Education records covered by the Family Educational Rights and Privacy Act. Student health records held by a school that receives Department of Education funding fall under FERPA, not HIPAA.
Records described in 20 U.S.C. 1232g(a)(4)(B)(iv), covering certain treatment records at postsecondary institutions.
Employment records held by a covered entity in its role as an employer. Workers’ compensation files and pre-employment physicals sit here.
Information regarding a person who has been dead for more than 50 years.¹

The employment-records exclusion catches many HR teams off guard. A hospital that employs nurses and maintains their occupational health files holds employment records, not PHI, even though the hospital itself is a covered entity. The same hospital’s patient files remain fully protected. Keeping those two streams separate is a constant operational task.

De-Identified Information

Data that has been properly de-identified is no longer individually identifiable, and HIPAA’s restrictions no longer apply. There are two paths, both set out in the companion rule at § 164.514. The safe harbor method requires stripping 18 specific identifier categories, including names, geographic detail smaller than a state, dates other than year, contact numbers, email addresses, Social Security and medical record numbers, account and license numbers, device serial numbers, URLs and IP addresses, biometric identifiers, full-face photographs, and any other unique identifying code. The first three digits of a zip code may stay if the area they cover has more than 20,000 people, and ages over 89 must be collapsed into “90 or older.” The covered entity must also have no actual knowledge that the remaining information could identify anyone.⁴

The alternative uses a qualified statistician or scientist who applies generally accepted methods to determine that the risk of identifying any individual is very small, and documents the analysis.⁴ There is no fixed numerical threshold for “very small,” which gives the expert discretion. Organizations pursuing large-scale analytics or research partnerships often prefer this route because it can preserve more of the data’s usefulness than the safe harbor.

Why These Definitions Decide Everything Else

The reason § 160.103 matters is that everything downstream turns on it. If an organization fits the covered entity or business associate definition, the Office for Civil Rights has enforcement reach over it, and the Department of Justice can pursue criminal cases against individuals who knowingly obtain or disclose PHI in violation of the rules.⁵

Civil penalties are tiered by the violator’s awareness and whether the problem was corrected. As adjusted for 2026, they run from $145 per violation at the “lack of knowledge” tier up to $2,190,294 per violation for willful neglect that is not corrected within 30 days, with an annual cap of $2,190,294 for each tier.⁶ A single breach can involve thousands of individual records, and each record can be a separate violation, so exposure in a large incident climbs quickly.

Anyone who believes their health information privacy rights have been violated can file a complaint with the Office for Civil Rights, which investigates both covered entities and their business associates.⁷ Whether that investigation lands on your organization at all is decided, in the first instance, by the definitions in § 160.103.

1
eCFR. 45 CFR 160.103 – Definitions
2
eCFR. 45 CFR Part 162 – Administrative Requirements
3
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
4
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
5
GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
6
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
7
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint