A patient asks for records, a software vendor requests access to appointment data, or an employee shares a medical note with HR. These situations can look similar, but the legal answer may differ. The question, “does HIPAA apply,” depends primarily on who holds the information, why they hold it, and how they use or disclose it. For healthcare businesses and the companies that support them, understanding that distinction is a practical part of managing privacy, contracts, and operational risk.
Does HIPAA apply to every business that handles health information?
No. HIPAA does not apply to every business simply because it receives or stores health-related information. The federal HIPAA rules generally apply to three types of organizations: covered entities, business associates, and certain subcontractors of business associates.
A covered entity is typically a healthcare provider, health plan, or healthcare clearinghouse that conducts certain administrative or financial transactions electronically. A medical practice that submits electronic insurance claims, for example, will commonly be a covered entity. Health insurers and many employer-sponsored group health plans may also be covered entities.
A business associate is a person or company that performs services for a covered entity or another business associate and, in doing so, creates, receives, maintains, or transmits protected health information. Common examples include billing companies, IT providers, cloud storage vendors, transcription services, consultants, and law firms handling patient information for a healthcare client.
The label on the business is not decisive. A technology company is not automatically subject to HIPAA just because its product is used in healthcare. But if that company hosts or can access protected health information for a covered medical practice, it may be acting as a business associate. Its contract, access controls, and privacy obligations should reflect that role.
What information is protected by HIPAA?
HIPAA protects protected health information, often called PHI. In plain English, PHI is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate. It can include medical records, diagnoses, treatment information, insurance details, billing records, appointment information, and identifying details connected to a person’s health care.
PHI is broader than many business owners expect. A patient name by itself is not necessarily PHI. But a patient name paired with the fact that the person has an appointment at a particular medical office, received a procedure, or has a specific insurance balance may be protected information.
HIPAA also applies to information in more than one format. Electronic records deserve significant attention because they create cybersecurity exposure, but paper charts, printed schedules, verbal discussions, and photographs can also involve PHI. A receptionist discussing a patient’s treatment within earshot of unrelated visitors can create a privacy concern even when no computer system is involved.
There are limits. Information that has been properly de-identified under HIPAA standards is not PHI. Likewise, data held by an organization that is not a covered entity or business associate may fall outside HIPAA, even if the information is personal and health-related. That does not mean the organization has no privacy obligations. State privacy laws, consumer protection rules, contractual commitments, professional duties, and other laws may still apply.
Does HIPAA apply to employee medical information?
Usually, HIPAA does not apply to employment records held by an employer in its role as an employer. This is one of the most common sources of confusion. If an employee gives a manager a doctor’s note, requests a workplace accommodation, or provides medical information for leave administration, that information is generally part of the employer’s employment records rather than HIPAA-regulated PHI.
That does not give an employer permission to handle the information casually. Other federal and state laws may require confidentiality and limit how medical information is used or shared. Depending on the facts, laws involving disability accommodation, family and medical leave, workers’ compensation, genetic information, and workplace privacy may be relevant. Employers should keep medical records separate from regular personnel files and limit access to those with a legitimate business need.
The analysis changes when an employer sponsors a group health plan. Health plan information may be subject to HIPAA, while employment records are not. A company that administers benefits internally needs a clear separation between personnel functions and plan functions. For example, staff who receive information to administer the health plan should not use it to make hiring, firing, promotion, or other employment decisions.
For professional practices, this distinction can be especially sensitive. A medical practice may be a HIPAA-covered provider when it handles patient information, but it is still an employer when it manages its own workforce. The same organization can hold both HIPAA-regulated records and employment records, each governed by different rules.
When does a vendor need a HIPAA business associate agreement?
A vendor generally needs a business associate agreement, or BAA, when it is a business associate and will create, receive, maintain, or transmit PHI on behalf of a covered entity or another business associate. The agreement is more than a formality. It allocates privacy and security responsibilities, restricts uses and disclosures of PHI, requires safeguards, and addresses breach reporting and downstream subcontractors.
Whether a BAA is necessary depends on the actual service and the vendor’s access to information. A janitorial company that cleans a medical office without routine access to patient records may not be a business associate. By contrast, a managed IT provider with administrative access to an electronic health record system likely is. A cloud vendor that stores encrypted patient files may also be a business associate, even if it does not actively review the contents.
Businesses should not assume that a vendor’s standard terms provide adequate HIPAA protection. Some platforms expressly offer a BAA for certain services and configurations, while excluding others. A healthcare practice should confirm what services are covered, whether the intended use is permitted, who can access data, where data is stored, and how the vendor will notify the practice of a security incident.
Subcontracting also matters. If a billing company hires another vendor to process PHI, that downstream relationship may require its own HIPAA-compliant agreement. A sound vendor review process should follow data access throughout the service chain, not stop with the first contract.
Does HIPAA apply to apps, websites, and telehealth tools?
Sometimes, but not automatically. A telehealth platform used by a covered healthcare provider to deliver care may handle PHI and may need to operate under a BAA. A patient portal connected to a provider’s electronic health record system is also likely part of the provider’s HIPAA-regulated operations.
Consumer-facing health apps are different. A symptom tracker, fitness wearable, fertility app, or wellness website may collect highly sensitive information without being subject to HIPAA. If the app collects data directly from consumers and is not acting for a covered entity or business associate, HIPAA may not govern that data. Other privacy and consumer protection laws may still create obligations, particularly when the business makes privacy promises, uses tracking technology, shares data for advertising, or serves residents of states with broader privacy laws.
Website tracking deserves special care for healthcare businesses. Analytics tools, advertising pixels, online scheduling functions, chat features, and form integrations can potentially transmit information about a visitor’s interaction with a healthcare site. Whether that information is PHI depends on the circumstances, but the risk should be assessed before deploying tools that send data to third parties.
For a startup developing healthcare technology, the better question is not simply whether the product is “HIPAA compliant.” The more useful analysis asks who the customer is, what data the product handles, whether it supports a covered entity’s functions, and what contractual and technical safeguards are needed for the intended use.
What should a business do if HIPAA may apply?
Start by mapping the information your business receives, where it is stored, who can access it, and which vendors touch it. This exercise often identifies issues that are easy to miss in day-to-day operations, such as shared email accounts, unapproved file-sharing tools, excessive employee access, or vendors working under incomplete contracts.
If your organization is a covered entity or business associate, it should have privacy and security policies suited to its actual operations, train the workforce, use appropriate safeguards, and maintain required agreements with relevant vendors. A HIPAA analysis should also consider incident response. If information is accessed, used, or disclosed improperly, the organization may need to investigate promptly and determine whether notification obligations apply.
Avoid treating HIPAA as a one-time paperwork project. A new scheduling system, acquisition, outsourced billing relationship, marketing campaign, or employee role change can alter the organization’s risk profile. Reviewing privacy obligations before implementing a new process is typically more efficient than trying to correct a problem after patient data has been exposed.
When the facts are unclear, targeted legal guidance can help a business distinguish HIPAA obligations from other privacy and employment rules, structure vendor agreements, and build practical processes that support both compliance and growth.
