What manufacturers, distributors, and growing employers need to know about covered entities, business associates, and the health data hiding in plain sight

Mention HIPAA in a room full of manufacturing or distribution leaders and you will usually get a polite shrug. HIPAA is for hospitals, clinics, and insurance companies. It is about patient charts and doctor visits. It has nothing to do with a company that machines parts, moves pallets, or runs an ERP system.

That assumption is understandable and often correct. It is also wrong more often than most companies realize. HIPAA does not regulate industries; it regulates specific roles and specific kinds of information. A company can fall into one of those roles without ever treating a patient, simply because of how it provides health benefits to employees, who it sells to, or what data passes through its systems.

This article explains, in plain terms, how HIPAA decides who is covered, the three most common ways companies like yours end up in scope, and what to do if you discover that you are.

HIPAA in Brief: Who It Actually Covers

HIPAA applies directly to two groups. The first is covered entities, which fall into three categories: health plans, healthcare clearinghouses, and healthcare providers that conduct certain transactions electronically, such as billing insurance.

The second group is business associates. A business associate is any person or organization that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. Think of billing companies, IT providers, cloud hosts, consultants, and certain suppliers. Since the 2013 Omnibus Rule, business associates have been directly liable for complying with key parts of HIPAA, not just contractually obligated to their customers.

The information at the center of all of this is protected health information, or PHI: individually identifiable health information held or transmitted by a covered entity or business associate. A name paired with a diagnosis, a claim, a prescription, or even an appointment can qualify. When that information is stored or sent electronically, it is called ePHI, and the HIPAA Security Rule governs how it must be protected.

Three Ways Companies Like Yours End Up in Scope

1. You Sponsor a Self Funded Health Plan

This is the most common and most overlooked path. Under HIPAA, a group health plan is itself a covered entity. When an employer self funds its plan, paying claims directly while a third-party administrator handles processing, the plan sits much closer to the employer, and so does the health information behind it.

The employer as an employer is not the covered entity; the plan is. In practice, however, the people who administer the plan are usually the employer’s own HR and finance staff. When they review claims reports, help an employee resolve a billing issue, or analyze high-cost claimants, they are handling PHI on behalf of the plan, and HIPAA’s privacy and security requirements follow that information.

Fully insured plans carry a lighter burden. If the employer receives only summary health information and enrollment data, many obligations shift to the insurer. Small plans with fewer than 50 participants that the employer administers entirely on their own are also excluded from HIPAA’s definition of a health plan. Most growing companies, though, fall outside both of those safe harbors.

2. You Sell to or Serve Healthcare Organizations

Distributors of medical supplies, manufacturers of devices or components, and service providers with hospital or clinic customers frequently become business associates without fully realizing it. If your team receives patient names with orders, handles returns tied to specific patients, supports equipment that stores patient data, or provides services that require access to a customer’s systems, your customer will likely ask you to sign a Business Associate Agreement.

That agreement is not a formality. It commits your company to safeguard PHI, report breaches, flow obligations down to your own subcontractors, and return or destroy data when the relationship ends. Under the HIPAA Security Rule update that HHS has proposed, business associates would also need to provide written verification, at least once a year, that required technical safeguards are actually in place.

3. Health Information Flows Through Your Systems

Even when a company is not formally a covered entity or business associate, health information has a way of appearing in places no one planned for it. A patient specific order in your ERP. A spreadsheet of claims data saved to a shared drive. An email thread between HR and a benefits broker. A Teams chat about an employee’s medical leave.

Not all of this is PHI under HIPAA, but all of it is sensitive, and much of it is subject to other laws governing employee medical information. Knowing where health data lives in your environment is the first step to knowing which rules apply to it.

The table below summarizes common scenarios. It is a starting point for conversation, not a legal determination.

What Being in Scope Actually Means

Once a company determines that HIPAA applies, the obligations fall into a few broad areas. The Privacy Rule governs how PHI can be used and disclosed. The Security Rule requires administrative, physical, and technical safeguards for ePHI, starting with a documented risk analysis. The Breach Notification Rule sets out who must be told, and when, if unsecured PHI is compromised. Business Associate Agreements tie the whole chain together.

The bar is also rising. In January 2025, HHS proposed the most significant update to the HIPAA Security Rule since 2013, including mandatory encryption, multifactor authentication, regular vulnerability scanning, annual penetration testing, and far more detailed documentation. The final rule has been delayed and is now projected for July 2027, but the current rule remains fully enforceable, and regulators continue to cite inadequate risk analysis as one of the most common failures in their investigations. Companies that start building these controls now will be in a far stronger position whatever the final rule looks like.

Five Questions to Ask This Quarter

A useful first step does not require outside auditors. It requires honest answers to a few questions.

1. Is our health plan self funded or fully insured, and who on our team has access to claims or plan level health data?
2. Have any customers asked us to sign a Business Associate Agreement, and do we know what we committed to?
3. Where does health information live in our environment, including email, Teams, shared drives, and our ERP?
4. When did we last complete a documented security risk analysis that covers that data?
5. Are multifactor authentication, encryption, and tested backups in place for the systems that hold it?

How 2W Tech Can Help

At 2W Tech, we work with manufacturers, distributors, and growing businesses that rarely think of themselves as healthcare organizations but still carry real responsibility for health information. We help teams locate where sensitive data lives, assess risk, and put practical safeguards in place across Microsoft 365, Epicor, and the infrastructure that supports them.

That includes multifactor authentication and device management, data loss prevention and sensitivity labeling in Microsoft 365, secure configuration of Epicor environments, and backup and recovery plans that can stand up to scrutiny. Because we support the full technology stack, we can help you build one coherent approach rather than a patchwork of point solutions.

If any of the questions above give you pause, contact us. We will help you understand where you stand and what to do next.

2W Tech. Every Solution. One Partner.

Read More:

Measuring Microsoft Copilot ROI Beyond Hours Saved

Ten Signs Your Epicor Investment Is Underperforming

Back to IT News