A. Covered Entity - Defined. The Privacy Rules apply to all covered entities and their business associates. A
covered entity is defined as a health care provider, and health plan or a health care clearing House.
1. A health care provider is "…a provider of medical or health services…or any other person or organization who
furnishes, bills, or is paid for health care in the normal course of business."
2. A health plan is - "…an individual or group plan that provides, or pays the cost of medical care…"
3. A health plan clearing house is -"…a public or private entity including a billing service…that processes or
facilitates the processing of health information."
B. Protected Health Information (PHI) defined. PHI is defined by the Privacy rules as information (including
demographics) collected from an individual by a health care provider, employer or health plan which relates to past,
present, or future physical or mental health care or conditions of an individual or the provision of health care
to an individual and which identifies the individual or could be reasonably believed to allow the identification of
the individual.
C. Business Associate - defined. A business associate, a “…person who…performs, or assists in the
performance of…A function or activity involving the use or disclosure of individually identifiable health information,
including claims processing or administration, data analysis, processing or administration, utilization review,
quality assurance, billing or benefits management.
