health plans, health care clearinghouses, and health care providers who transmit health information electronically -- and their **business associates** (organizations that handle PHI on behalf of covered entities, such as billing companies, cloud storage providers, and data analytics firms).