What are the PHI changes under HIPAA update 2025 (workflow)

Covered entities are defined in the HIPAA rules as

• health plans,
• health care clearinghouses, and
• health care providers

who electronically transmit any health information in relation to transactions for which HHS has adopted standards. These transactions generally cover billing and payment for services or insurance coverage. 

The HHS standards can be found in Subparts I to S of the HIPAA Administrative Data Standards. In the context of what is considered PHI under HIPAA for qualifying healthcare providers:

• “A broken leg” is health information.
• “Mr. Jones has a broken leg” is individually identifiable health information.
• If a covered entity records “Mr. Jones has a broken leg” the identifier (“Mr. Jones”) and the health information (“broken leg”) is protected.

Health Plan – With certain exceptions, an individual or group plan that provides or pays the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)). The law specifically includes many types of organizations and government programs as health plans.

Health Care Clearinghouse – A public or private entity, including a billing service, re-pricing company, community health management information system or community health information system, and “value-added” networks and switches that either process or facilitate the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction, or receive a standard transaction from another entity and process or facilitate the processing of health information into a nonstandard format or nonstandard data content for the receiving entity.

Health Care Provider – A provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.

Health Care – Care, services, or supplies related to the health of an individual, including

1. Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual that affects the structure or function of the body; and
2. Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.

Do note that the HIPAA Privacy Rule applies only to covered entities; it does not apply to all persons or institutions that collect individually identifiable health information. It may, however, affect other types of entities that are not directly regulated by the rule if they, for instance, rely on covered entities to provide PHI.

Researchers are also considered covered entities. That is if they are also health care providers who electronically transmit health information in connection with any transaction for which HHS has adopted a standard. For example, physicians who conduct clinical studies or administer experimental therapeutics to participants during the course of a study must comply with the Privacy Rule if they meet the HIPAA definition of a covered entity.

Business Associate

A business associate is defined as any individual or organization that performs or assists with tasks involving the use or disclosure of identifiable health information, such as data analysis, claims processing, utilization review, or quality assurance. They may also provide legal, accounting, consulting, financial, or administrative services that require access to PHI. However, members of a covered entity’s workforce are not considered business associates. Additionally, one covered entity may act as a business associate for another covered entity.

The Privacy Rule also safeguards individually identifiable health information when managed or created by a business associate—an individual or organization performing certain tasks for a covered entity. A business associate is someone who is not part of the covered entity’s workforce but assists in activities regulated by the HIPAA Administrative Simplification Rules, including the Privacy Rule. These activities may involve the use or disclosure of identifiable health information or providing services that require such disclosures.

Since HIPAA Administrative Simplification Rules do not directly govern research activities, researchers or research sponsors are not required to become business associates for research purposes. However, covered entities may enlist business associates to de-identify PHI, prepare limited data sets, or conduct data aggregation.

To ensure data protection, the Privacy Rule mandates that covered entities enter into written agreements (or other approved arrangements for government entities) with their business associates. This agreement must confirm that the business associate will adequately safeguard the PHI. Except for limited exceptions, these agreements must restrict business associates from using or disclosing PHI in ways that would violate the Privacy Rule if carried out by the covered entity itself.