HIPAA obligations generally attach to covered entities and their business associates (and relevant subcontractors), not to every company that has ever emailed a doctor.
Covered entities (high level)
Health plans, health care clearinghouses, and health care providers who conduct certain electronic transactions.
Business associates
Service providers that handle ePHI for a covered entity—billing, cloud hosting, IT providers, transcription, etc.—often under a BAA.
Not legal advice. Classification depends on facts and contracts. Use counsel for determinations.
Want help applying this?
Book a free 15-minute review. For a structured baseline—including HIPAA-oriented paths—see ImpetraInsights™.