A covered entity is a healthcare organization, health insurer, or clearinghouse that is regulated under HIPAA. In practice, this includes hospitals, clinics, health plans, and some other organizations that create, receive, store, or transmit protected health information.
This term matters because HIPAA obligations attach to covered entities: they must safeguard patient data, manage access, and maintain appropriate administrative, physical, and technical controls. In cyberattacks, covered entities are often the primary target for ransomware, phishing, and identity theft because they hold valuable ePHI and need continuous availability. In defense, the label helps define who is responsible for risk analysis, incident response, vendor oversight, and recovery planning. Business associates may support these organizations, but the covered entity remains central to compliance and accountability.