What is a healthcare clearinghouse under HIPAA?
What a health care clearinghouse is under HIPAA, how it differs from a billing company, which rules apply to it, and why clearinghouses matter for practices' security.
On this page
Health care clearinghouses at a glance
A health care clearinghouse is one of HIPAA's three kinds of covered entity. It is an organization — including a billing service, repricing company or value-added network — that converts health information between nonstandard formats and the standard electronic transactions HIPAA requires, in either direction. Clearinghouses must follow the Security Rule; when they handle PHI as a business associate of a provider or plan, only part of the Privacy Rule applies and they may use the PHI only as their business associate agreement allows.
| Covered entity type | One of three: health plans, providers, clearinghouses |
|---|---|
| Defining function | Converts nonstandard data into standard transactions, or standard into nonstandard |
| Can include | Billing services, repricing companies, value-added networks and switches |
| Privacy Rule | Applies in part when acting as a business associate (164.500(b)) |
| Security Rule | Applies |
| Largest breach to date | Change Healthcare (2024) — 192.7 million people reported to OCR |
The definition
HIPAA defines a health care clearinghouse as a public or private entity — expressly including a billing service, repricing company, community health management information system, and “value-added” networks and switches — that does either of two things (45 CFR 160.103):
- Processes health information received from another entity in a nonstandard format or with nonstandard content into standard data elements or a standard transaction; or
- Receives a standard transaction and processes the information into nonstandard format or content for the receiving entity.
The status comes from the function, not the name. A company that takes a practice’s print file or spreadsheet and turns it into standard 837 claims is performing a clearinghouse function. A billing company that only keys claims into a payer portal is typically a business associate, not a clearinghouse — see medical billing and coding companies.
Which rules apply
Clearinghouses are covered entities, alongside health plans and providers. In practice they almost always work for providers and plans under a business associate agreement. When a clearinghouse creates or receives PHI as a business associate, only specified parts of the Privacy Rule apply to it, and it may use or disclose that PHI only as the business associate contract permits (45 CFR 164.500(b)). It does not, for example, issue its own Notice of Privacy Practices for that information. The Security Rule and breach notification duties apply.
Why it matters to a practice
Clearinghouses connect thousands of providers to hundreds of payers, so an attack on one can affect patients of practices that never dealt with the attacker directly. The 2024 ransomware attack on Change Healthcare, a clearinghouse, became the largest health data breach reported to OCR — 192.7 million people in Change’s July 2025 update. HHS published FAQs on who must notify whom after that incident.
For a practice: list your clearinghouse in your vendor register, make sure the BAA is signed, include it in your risk analysis, and have a plan for submitting claims if it goes down.
Related requirements
- Covered entity →§ 160.103
- Business associate →§ 160.103
- Business associate agreements (BAAs) →§ 164.502(e)
Frequently asked questions
What is a healthcare clearinghouse?
A company that sits between providers and health plans and converts claims and other health data into the standard electronic formats HIPAA requires, or back again. Under HIPAA it is a covered entity.
Is a clearinghouse a covered entity or a business associate?
Both, in practice. It is a covered entity by definition, but it usually handles PHI on behalf of providers or plans under a business associate agreement, which limits what it may do with that PHI.
Is every medical billing company a clearinghouse?
No. Only one that performs the conversion function — turning nonstandard data into standard transactions or the reverse — meets the definition. Other billing companies are business associates.