HIPAA does not apply to everyone because it regulates only HIPAA Covered Entities and Business Associates, along with their workforce members when acting within those regulated functions.
Organizations And People Covered By HIPAA
HIPAA applies to HIPAA Covered Entities.
HIPAA Covered Entities include health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions.
HIPAA applies to Business Associates.
Business Associates create, receive, maintain, or transmit protected health information on behalf of a HIPAA Covered Entity, or provide services involving protected health information.
HIPAA applies to workforce members of HIPAA Covered Entities and Business Associates when they perform work for the regulated organization and handle protected health information.
People And Organizations Not Covered By HIPAA
Individuals are not regulated by HIPAA when sharing their own health information outside a HIPAA Covered Entity or Business Associate relationship.
Most employers are not regulated by HIPAA for employment records held in the employer role. An employer can be subject to HIPAA through a sponsored group health plan that is a HIPAA Covered Entity or through an onsite clinic that functions as a healthcare provider and meets HIPAA Covered Entity criteria.
Many consumer services are not regulated by HIPAA when they are not acting for a HIPAA Covered Entity or Business Associate and do not sign a Business Associate Agreement.
What HIPAA Protects When It Applies
HIPAA protects protected health information handled by a HIPAA Covered Entity or Business Associate.
The HIPAA Privacy Rule governs permitted uses and disclosures and individual rights.
The HIPAA Security Rule governs safeguards for electronic protected health information.
The HIPAA Breach Notification Rule governs notification duties for breaches of unsecured protected health information.
The HIPAA Minimum Necessary Rule limits uses, disclosures, and requests when the rule applies.