Am I a HIPAA Covered Entity?
By ComplyCreate Editorial Team · Published Apr 24, 2026 · Last reviewed Apr 25, 2026
Answer 10 questions to determine your HIPAA status and get a personalized compliance checklist based on your situation. Takes about 3 minutes.
You are likely a Covered Entity
As a covered entity, you must comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. This means an NPP for patients, BAAs with vendors, a Security Risk Analysis, and written policies.
Your immediate action items:
- Create or update your Notice of Privacy Practices
- Generate BAAs for all vendors who handle your patients' PHI
- Conduct a Security Risk Analysis
- Review the complete list of required HIPAA documents
You are likely a Business Associate
As a business associate, you must sign BAAs with each covered entity customer, implement Security Rule safeguards for ePHI, conduct a Security Risk Analysis, and comply directly with the Breach Notification Rule (HITECH).
Your immediate action items:
- Generate BAAs to provide to covered entity customers
- Sign BAAs with your own subcontractors who handle PHI
- Conduct a Security Risk Analysis for your ePHI systems
- Read the Business Associates guide for full BA obligations
You may be Both a CE and BA
Some organizations operate as both covered entities (for their own patient services) and business associates (providing services to other healthcare organizations). You have obligations in both roles.
Your immediate action items:
- Create an NPP for your patients
- Generate BAAs both for your customers and your vendors
- Read our BAA vs NPP comparison to understand both documents
You may not be subject to HIPAA
Based on your answers, you may not meet the threshold for a covered entity or business associate. However, you may still be subject to state health privacy laws, and this determination can change if your business model or services change.
We recommend:
- Review applicable state health privacy laws in your jurisdiction
- Read our covered entity guide to confirm this assessment
- Consider consulting a healthcare attorney for a definitive determination