A covered entity subject to the Privacy Rule is defined by the rule to mean:

A health care provider meeting one or more of the criteria defined below is subject to the Privacy Rule.

Health care provider means a provider of services as defined in section 1861(u) of the Social Security Act, a provider of medical or health services as defined in section 1861 (s) of the Social Security Act, and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.

the healthcare provider transmits any health information in electronic form in connection with a transaction covered by the rule

What to do if your organization is subject to the Medical Privacy Rule