A billing company in Tennessee lost $2.3 million because its leadership believed HIPAA was a hospital problem, not theirs. CHSPSC LLC, a management company that handled operations for Community Health Systems, learned the hard way in 2020 when OCR came knocking after a breach affecting over 6 million individuals. So does HIPAA only apply to healthcare workers? Not even close. And this misunderstanding keeps costing organizations millions.

The Short Answer: No, HIPAA Applies Far Beyond Healthcare Workers

HIPAA covers three categories of organizations: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. The law calls these covered entities. But here's where most people stop reading — and where the trouble starts.

HIPAA also covers every business associate that touches protected health information (PHI) on behalf of a covered entity. That means IT vendors, billing companies, cloud storage providers, shredding services, law firms, accountants, and consultants. If your organization handles PHI in any capacity, HIPAA applies to you.

I've seen this misconception play out dozens of times. A medical transcription company assumes HIPAA is the doctor's problem. A marketing firm handling patient testimonials thinks they're exempt. A software startup building a patient portal figures the hospital bears all the risk. They're all wrong.

Who Exactly Does HIPAA Cover? The Full List Will Surprise You

Covered Entities

  • Healthcare providers: Doctors, hospitals, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies — but only those who transmit health information electronically in connection with certain transactions.
  • Health plans: Health insurance companies, HMOs, employer-sponsored group health plans, Medicare, and Medicaid.
  • Healthcare clearinghouses: Organizations that process nonstandard health information into standard formats. Most people have never heard of these, but they're fully covered.

Business Associates

This is the category that catches organizations off guard. Under the HITECH Act and the 2013 Omnibus Rule, business associates bear direct liability for HIPAA violations. HHS made this crystal clear: if you create, receive, maintain, or transmit PHI on behalf of a covered entity, you are a business associate.

Real-world examples of business associates include:

  • IT service providers managing electronic health records (EHR)
  • Cloud hosting companies storing ePHI
  • Billing and coding companies
  • Answering services that take patient messages
  • Attorneys with access to patient records
  • Accountants who audit healthcare organizations
  • Shredding companies that destroy paper PHI

Subcontractors of Business Associates

Here's a layer most people miss entirely. If a business associate hires a subcontractor who will access PHI, that subcontractor is also bound by HIPAA. The chain doesn't break. Every link carries liability.

The $4.3 Million Mistake: When Non-Clinical Staff Ignore HIPAA

In 2016, OCR settled with Advocate Health Care Network for $5.55 million after multiple breaches. One involved unencrypted laptops stolen from an administrative support center — not a hospital floor, not a clinic. Administrative staff. Non-clinical employees. The breach affected approximately 4 million individuals.

I bring this up because it demolishes the myth that HIPAA is only a clinical concern. The people who triggered that breach weren't nurses or doctors. They were office workers whose organization hadn't implemented proper safeguards or adequate workforce training.

What About Employers, Schools, and Law Enforcement?

Here's where the question "does HIPAA only apply to healthcare workers" gets more nuanced. HIPAA does not apply to:

  • Employers in their role as employers (employee health records in HR files aren't covered by HIPAA, though other laws may protect them)
  • Schools — student health records fall under FERPA, not HIPAA
  • Law enforcement agencies — unless they also operate as a covered entity
  • Life insurance companies — they aren't health plans under HIPAA
  • Gym or fitness apps — unless they qualify as a business associate

But the moment any of these organizations enters into a business associate agreement with a covered entity and handles PHI, HIPAA applies. Context matters. The same IT firm might be exempt in one business relationship and fully liable in another.

Why This Misunderstanding Keeps Causing Breaches

In my experience, the organizations most vulnerable to HIPAA enforcement actions are the ones that never thought HIPAA applied to them. They skip risk assessments. They don't encrypt ePHI. They never train their workforce. Then a breach happens, and OCR doesn't care about their assumptions.

OCR's resolution agreements page tells the story clearly. A significant number of settlements involve business associates and non-clinical entities — not just hospitals and doctor's offices.

The pattern I see most often: a covered entity signs a business associate agreement, but the business associate treats it as a formality. No policies get written. No training happens. No risk analysis is conducted. When a breach hits, both parties face investigation.

Your Workforce Needs Training — Even If They Never Touch a Patient

HIPAA's Privacy Rule requires every covered entity and business associate to train their entire workforce on PHI handling. Note the word "workforce" — not "clinical staff." HHS defines workforce broadly: employees, volunteers, trainees, and any person under the direct control of the organization, whether or not they are paid.

That means your front desk receptionist, your janitor who empties trash cans full of paper records, your IT admin with server access, and your summer intern all need HIPAA training. If they can see, hear, or access PHI, they're in scope.

Our HIPAA Fundamentals course covers exactly this — who HIPAA applies to, what PHI looks like in practice, and what every workforce member needs to know regardless of their role. For clinical settings where nurses handle the bulk of PHI interactions, our HIPAA Training for Nurses goes deeper into workflow-specific scenarios.

And for organizations employing community health workers who operate outside traditional clinical settings — often in patients' homes and community spaces — our HIPAA Training for Community Health Workers addresses the unique compliance challenges they face daily.

The Business Associate Agreement Trap

Signing a business associate agreement (BAA) doesn't make you compliant. It makes you liable. I've reviewed BAAs for organizations that signed them without reading them, without implementing a single safeguard listed inside, and without understanding that they'd just accepted direct HIPAA responsibility.

A BAA is a legal document that spells out your obligations under HIPAA. Once you sign it, OCR can hold you accountable for every requirement in the Security Rule, the Privacy Rule, and the Breach Notification Rule. If you thought HIPAA was someone else's problem, that signature changed everything.

How to Know If HIPAA Applies to Your Organization

Ask yourself three questions:

  • Does your organization provide healthcare, process health transactions, or offer health insurance?
  • Does your organization handle, store, transmit, or have access to PHI on behalf of a covered entity?
  • Has your organization signed a business associate agreement — or should it have?

If you answered yes to any of these, HIPAA applies to you. Full stop. The size of your organization doesn't matter. There is no small-business exemption. A two-person IT consultancy with access to a clinic's EHR system carries the same HIPAA obligations as a national health system.

What Happens When Non-Covered Organizations Get It Wrong

OCR has made examples of business associates who ignored their obligations. In 2018, OCR settled with Fresenius Medical Care North America for $3.5 million following five separate breach incidents. Multiple breaches involved non-clinical locations and failures in basic safeguards that any organization — clinical or not — should have had in place.

The penalties aren't theoretical. They're documented, public, and escalating. HHS has signaled repeatedly that business associate enforcement is a priority, not an afterthought.

Stop Assuming. Start Training.

The question "does HIPAA only apply to healthcare workers" reflects a dangerous blind spot. HIPAA applies to a vast ecosystem of organizations, roles, and relationships. If PHI passes through your hands, your servers, or your filing cabinets, you're in scope.

Don't wait for a breach to find out. Conduct a risk assessment, train your entire workforce, and treat your business associate agreements as the legally binding obligations they are. Your compliance isn't optional — and it's not someone else's responsibility.