50 State HIPAA Privacy Study

The entities included in the 50 State HIPAA Privacy Study ("Study Entities") were selected for inclusion by the funders of the Privacy Study. Most of the Study Entities are considered to be covered entities under HIPAA and therefore are subject to HIPAA’s direct regulation. It is important to note, however, that health care providers are not necessarily covered entities under HIPAA. According to HIPAA, a health care provider is not a covered entity unless it engages in certain electronic billing and claims processing transactions under HIPAA. All health care provider Study Entities are treated as HIPAA covered entities for purposed of the Privacy Study, however each such entity should confirm for itself whether it in fact engages in electronic transactions that subjects it to HIPAA requirements.

The Privacy Study also includes six (6) Study Entities that are not usually considered covered entities under HIPAA. These entities may have business relationships with covered entities or their business could be otherwise impacted by the HIPAA compliance activities of covered entities. These Study Entities are: Medical Technology Companies, Pharmaceutical/Device Manufacturers, Pharmacy Benefits Managers (engaged only in administrative/claims services), Third Party Administrators, Underwriters and Utilization Review Organizations. Privacy Study information pertaining to these Study Entities will include only relevant state health information privacy rules and not HIPAA rules. However users clicking on one of these Study Entities will be prompted to note that the entity is not covered by HIPAA, but that the entity may do business with other entities included in the Privacy Study. The prompt will provide a couple of examples of potential Study Entities with whom there may be a business relationship. These examples are meant only to direct the user to various kinds of HIPAA covered entities and are not meant to infer the presence of specific business associate relationships under HIPAA.

The Study Entities are as follows (with explanation, if necessary, of the definition of the entity for purposes of the Privacy Study):

Ambulatory Surgery Centers (sometimes known as outpatient surgery centers)
Assisted Living/Intermediate Care Facilities (referred to by various names under state law, includes residential entities in which some level of health care is provided)
Clinical Laboratories (excluding forensic laboratories)
Clinical Social Workers
Clinics (including physician groups, diagnostic centers and other entities providing physical and mental health treatment, substance abuse and abortion services)
Dialysis Providers
Durable Medical Equipment/Supplies Suppliers (engaged in providing DME and supplies and billing third party insurance and government programs)
Employer Plans (health benefits plans offered by employers to their workers and referred to under HIPAA as "group health plans;" does not include state or federal health benefits programs administered by government agencies)
Health Care Technicians
HMOs (health maintenance organizations)
Home Health Agencies
Hospices
Hospitals
Insurers (health insurance entities subject to state insurance laws and regulations; excluding entities operating under nonprofit hospital corporation "Blue Cross plan" or nonprofit medical services corporation "Blue Shield" laws, although these entities would be included to the extent they are subject to a state’s health insurer, HMO or PPO laws and regulations)
Long Term Care/Skilled Nursing Facilities (referred to by various names under state law; refers primarily to nursing homes and similar entities)
Medical Technology Companies (not covered under HIPAA, but may have business relationships with HIPAA covered entities)
Nurses/Nurse Practitioners/Nurse Midwives
Occupational Therapists
Pharmaceutical and Device Manufacturers (not covered under HIPAA, but may have business relationships with HIPAA covered entities)
Pharmacies/Pharmacists
Pharmacy Benefit Managers (not covered under HIPAA if engaged only in administrative/claims services, but may have business relationships with HIPAA covered entities; if engaged in pharmacy operations, see Pharmacies/Pharmacists)
Physical Therapists
Physician Assistants
Physicians (including M.D.s and D.O.s) (does not include state- or court-appointed physician services)
Podiatrists
PPOs (preferred provider organizations)
Rehabilitation Facilities (includes inpatient rehabilitation hospitals, outpatient physical therapy facilities and substance abuse treatment centers providing physical, mental health and substance abuse rehabilitation services)
Respiratory Therapists
Speech Therapists
Third-Party Administrators (not covered under HIPAA, but may have business relationships with HIPAA covered entities)
Underwriters (not covered under HIPAA, but may have business relationships with HIPAA covered entities)
Utilization Review Organizations (referred to by various names under state law; not covered under HIPAA, but may have business relationships with HIPAA covered entities)

June 19, 2013