Under HIPAA, which entities are considered Covered Entities?

• A. A patient organization
• B. Health information exchanges
• C. Healthcare providers, health plans, and healthcare clearinghouses
• D. Pharmaceutical manufacturers

Answer: (C)

Covered Entities under HIPAA are the groups that directly handle protected health information in electronic form as part of standard health care transactions—namely healthcare providers who transmit PHI electronically, health plans, and healthcare clearinghouses. These entities are the ones required to comply with HIPAA Privacy and Security Rules because they create, receive, maintain, or transmit PHI in electronic form tied to covered transactions.

This is why the listed trio is the correct answer: it matches the formal definition of who HIPAA designates as covered entities. The other options don’t fit because a patient organization isn’t automatically a covered entity under HIPAA, pharmaceutical manufacturers aren’t defined as covered entities, and health information exchanges aren’t categorized as covered entities (they may function under other roles, such as business associates, depending on their activities).