HIPAA binds providers who bill electronically, not everyone holding health data

The Health Insurance Portability and Accountability Act (HIPAA) of 1996
establishes federal standards protecting sensitive health information from
disclosure without the patient's consent. The Privacy Rule implements
those requirements, and the Security Rule protects a subset of the same
information.

What the Privacy Rule does

It addresses **the use and disclosure of individuals' protected health
information (PHI)** by the entities subject to it, and sets standards for
**individuals' rights to understand and control how their health information
is used**.

The stated balance: **protecting individual health information while allowing
necessary access**, promoting high-quality healthcare and protecting public
health.

The definition people get wrong

HIPAA does not cover everyone who holds health information about you. It
covers "covered entities" — and for a healthcare provider, the test is
unexpected:

**Every healthcare provider, regardless of size of practice, who
electronically transmits health information in connection with certain
transactions** — claims, benefit eligibility inquiries, referral
authorisation requests, and others.

**The trigger is the electronic transaction, not the sensitivity of the
data.** A provider who never bills electronically may fall outside the rule
entirely, while a one-person practice that submits a single electronic claim
is covered.

This is why so many organisations that hold health information — fitness apps,
employers, many wellness services — are not bound by HIPAA. They are not
covered entities, and people routinely assume otherwise.

*Source: Centers for Disease Control and Prevention, Public Health Law
Program.*