A covered entity subject to the Privacy Rule is defined by the rule to mean:

A health plan or group health plan meeting one or more of the criteria defined below is subject to the Privacy Rule.

Group health plan (also see definition of health plan) means an employee welfare benefit plan as defined in section 3(1) of the Employee Retirement Income and Security Act of 1974(ERISA), including insured and self-insured plans, to the extent that the plan provides medical care as defined in section 2791(a)(2) of the Public Health Service Act (PHS Act), including items and services paid for as medical care, to employees or their dependants directly or through insurance, reimbursement, or otherwise, that:

(1) has 50 or more participants as defined by ERISA, or
(2) is administered by an entity other than the employer that established and maintains the plan.

Health Plan means an individual or group plan that provides, or pays the cost of, medical care. A health plan includes the following, singly or in combination:

- A group health plan as defined above,
- A health insurance issuer, as defined in this section,
- An HMO which is defined as a federally qualified HMO, an organization recognized as an HMO under state law, or a similar organization regulated for solvency under State law in the same manner and to the same extent as such an HMO.
- Part A or Par B of the Medicare program under title XVIII of the Social Security Act.
- The Medicaid program under title XIX of the Social Security Act.
- An issuer of a Medicare supplemental policy as defined by the Social Security Act
- An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.
- An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers.
- The health care program for active military personnel.
- The veterans health care program.
- The civilian health and medical program of the uniformed services (CHAMPUS)
- The Indian Health Service Program
- The Federal Employees Health Benefits Program
- An approved State child health plan providing benefits for child health assistance that meet the requirements of the Social Security Act.
-The Medicare + Choice program of the Social Security Act.
- A high risk pool that is a mechanism established under state law to provide health insurance coverage or comparable coverage to eligible individuals,
- Any other individual or group plan, or combination of group plans, that provides or pays for the cost of medical care.

Small Health Plan means a health plan with annual receipts of $5 million or less.

A health plan excludes:

- Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 279(c)(1) of the Pubic Health Services Act., and
- A government funded program other than the programs listed on the preceding paragraph:

--Whose principal purpose is other than providing, or paying the cost of, health care; or
-- whose principal activity is:

The direct provision of health care to persons, or
The making of grants to fund the direct provision of health care to persons.

What to do if your organization is subject to the Medical Privacy Rule