Are all of the entities listed in the Privacy Study subject to HIPAA?
No. While all of the entities included in the Privacy Study will be affected by the HIPAA rules, they are not all covered entities directly subject to HIPAA. A number of entities that are not HIPAA covered entities are included in the Privacy Study because they may have business relationships with covered entities, or their business could otherwise be directly impacted by the changes covered entities must make to comply with HIPAA (including medical technology companies, pharmaceutical/device manufacturers, pharmacy benefits managers, third-party administrators, underwriters, utilization review organizations). To avoid confusion, all of the records for those entities not covered by HIPAA include a notice indicating that HIPAA does not apply directly to them, and then suggests examples of types of covered entities included in the Privacy Study with whom they may do business who are HIPAA covered entities. While this is meant to assist the non-covered entities in determining the privacy
