A covered entity subject to the Privacy Rule is defined by the rule to mean:

A health care clearinghouse meeting one or more of the criteria defined below is subject to the Privacy Rule.

Health care clearinghouse means a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and "value-added" networks and switches, that does either of the following functions:

(1) Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction, or
(2) Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.

What to do if your organization is subject to the Medical Privacy Rule