Are Pharmacy Benefit Managers (PBMs) classified as covered entities?

Pharmacy Benefit Managers (PBMs) are typically classified as business associates rather than covered entities under HIPAA. Covered entities include healthcare providers who transmit any health information in electronic form in connection with a HIPAA transaction, health plans, and healthcare clearinghouses. PBMs do not fall into these categories inherently, as their primary role is managing prescription drug benefits on behalf of health plans, rather than providing healthcare or health coverage directly.

While PBMs may handle protected health information (PHI) as part of their operations, which requires them to comply with some HIPAA regulations, they do so in the capacity of a business associate. This classification means they must adhere to HIPAA rules, particularly concerning the privacy and security of PHI, but they do not meet the criteria to be considered a covered entity themselves unless they also operate as a healthcare provider or health plan in some capacity.

Therefore, the notion that PBMs are not classified as covered entities is accurate, and this understanding is crucial for comprehending the broader context of HIPAA compliance within the healthcare industry.