This is archived HHS content.

FAQs Categories

Covered Entities

Who must comply with HIPAA privacy standards?

When is an authorization required from the patient before a provider or health plan engages in marketing to that individual?

When is a researcher considered to be a covered health care provider under HIPAA?

Are state, county or local health departments required to comply with the HIPAA Privacy Rule?

Are the following types of insurance covered under HIPAA: long/short term disability; workers' compensation; automobile liability that includes coverage for medical payments?

Is an entity that is acting as a third party administrator to a group health plan a covered entity?

The Social Security Administration (SSA) collects medical records when making disability determinations for both title II (Disability Insurance) and title XVI (Supplemental Security Income, SSI) of the Social Security Act. Is SSA a covered entity (e.g., a health plan)?

Is a flexible spending account or a cafeteria plan a covered entity for purposes of the Privacy Rule and the other HIPAA, Title II, Administrative Simplification standards?

Were there Privacy Rule compliance deadlines in 2004?

Must all small health plans comply with the Privacy Rule?

I’m an employer that offers a fully insured group health plan for my employees. Is the fully insured group health plan subject to all of the Privacy Rule provisions?

As an employer, I sponsor a group health plan for my employees. Am I a covered entity under HIPAA?

Are tissue repositories covered entities?

Can health care providers invite or arrange for members of the media, including film crews, to enter treatment areas of their facilities without prior written authorization?

This is archived HHS content.