HIPAA is a US set of rules on protected health information. This glossary defines the terms that cause most confusion, such as covered entity, business associate, ePHI, risk analysis and addressable, using the text of the federal regulations so you can check each one yourself.
Who is covered?
Covered entity. Under 45 CFR 160.103, a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with certain standard transactions.
Health care clearinghouse. A public or private entity, including a billing service or repricing company, that converts health information between standard and nonstandard formats for other entities.
Business associate. A person who, for a covered entity, creates, receives, maintains or transmits protected health information for a regulated function, or provides certain services involving disclosure of it. Subcontractors that handle the data can qualify too. A software vendor that stores a hospital's records is a typical case.
Business associate agreement (BAA). The written contract between a covered entity and a business associate that sets out how the information is safeguarded. We did not fetch the contract requirements for this post, so have counsel confirm the wording you need.
What is protected?
Protected health information (PHI). Individually identifiable health information that is sent or stored electronically or kept in any other medium. The definition excludes certain education records, employment records an employer holds in its role as employer, and information about people deceased for more than 50 years.
ePHI. PHI in electronic form. The Security Rule applies to it.
What does the Security Rule require?
General rules (164.306). Protect the confidentiality, integrity and availability of ePHI against reasonably expected threats and impermissible uses. You choose measures that are reasonable for your size, technical infrastructure, cost and the likelihood and severity of risk.
Required. An implementation specification you must implement.
Addressable. Not optional. You assess whether it is reasonable and appropriate. If so, implement it. If not, document why and, where reasonable, adopt an equivalent measure.
Administrative safeguards (164.308). The standards are security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan and evaluation.
Risk analysis. A required part of the security management process: evaluate threats and weaknesses that could affect ePHI.
Risk management. Adopt controls that lower those risks to an acceptable level.
Sanction policy. A rule for disciplining workforce members who break security policies.
Information system activity review. Periodically examine logs, access reports and incident tracking records.
What happens when something goes wrong?
Breach notification. A covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of a breach (45 CFR 164.404). A delay is allowed solely as the rule provides for law enforcement requests.
What to do
- Decide whether you are a covered entity, a business associate, or neither. Write the reasoning down.
- List every system that stores or moves ePHI, including logs, backups and test data.
- Run and date a risk analysis. Everything else in the Security Rule builds on it.
- For each addressable item, record the decision and the reason.
- List your vendors that touch PHI and confirm a BAA exists with each.
- Set up log review you can show an auditor, and keep the review record.
- Rehearse the breach timeline so the 60 day limit is a plan, not a surprise.
Software supply chain visibility helps with steps 2 and 3, because you cannot analyze risk in components you have not inventoried. Safeguard's compliance automation can organize that evidence, but it does not make an organization compliant or certify anything. Qualified counsel and your own risk analysis decide that.
Quick check
Is addressable the same as optional?
No. You must assess it. If it is reasonable and appropriate you implement it. If not, you document why and adopt an equivalent where reasonable.
Does HIPAA apply to a SaaS company?
It can, as a business associate, if you create, receive, maintain or transmit PHI for a covered entity. Check the definition and your contracts with counsel.
Sources
- 45 CFR 160.103 Definitions (Cornell LII), fetched 18 October 2026
- 45 CFR 164.306 Security standards: general rules, fetched 18 October 2026
- 45 CFR 164.308 Administrative safeguards, fetched 18 October 2026
- 45 CFR 164.404 Notification to individuals, fetched 18 October 2026
This is general information, not legal advice.
Last reviewed: 18 October 2026.
