HIPAA applies to [Covered Entities] () and [Business Associates] (). Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Business associates are third-party vendors that deal with PHI (Protected Health Information) on behalf of a covered entity.