(a) Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information.
(b) Health care clearinghouses must comply with the standards, requirements, and implementation specifications as follows:
(1) When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with:
(i) Section 164.500 relating to applicability;
(ii) Section 164.501 relating to definitions;
(iii) Section 164.502 relating to uses and disclosures of protected health information, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;
(iv) Section 164.504 relating to the organizational requirements for covered entities;
(v) Section 164.512 relating to uses and disclosures for which individual authorization or an opportunity to agree or object is not required, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;
(vi) Section 164.532 relating to transition requirements; and
(vii) Section 164.534 relating to compliance dates for initial implementation of the privacy standards.
(2) When a health care clearinghouse creates or receives protected health information other than as a business associate of a covered entity, the clearinghouse must comply with all of the standards, requirements, and implementation specifications of this subpart.
(c) Where provided, the standards, requirements, and implementation specifications adopted under this subpart apply to a business associate with respect to the protected health information of a covered entity.
(d) The standards, requirements, and implementation specifications of this subpart do not apply to the Department of Defense or to any other federal agency, or non-governmental organization acting on its behalf, when providing health care to overseas foreign national beneficiaries.
[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013]
Notes of Decisions
Cited in
28
cases (
9 in the last 5 years), 2004–2025 · leading case:
T.M. v. Elwyn, Inc., 950 A.2d 1050 (Pa. Super. Ct. 2008).
T.M. v. Elwyn, Inc., 950 A.2d 1050 (Pa. Super. Ct. 2008).
· cites it 4× “Additionally, the statute required the Secretary of Health and Human Services to promulgate privacy regulations, which are now codified at 45 C.F.R. §§ 164.500 164.534. Elwyn contends that it constitutes a "covered entity" within the meaning of HIPAA and, therefore, must…”
Ctr. v. Superior Court, 194 Cal. App. 4th 288 (Cal. Ct. App. 2011).
“1936 ) ( 45 C.F.R. § 164.500 et seq. (2010)). In February 2006, the court entered an order permitting class plaintiffs to obtain medical information from the Center.”
In re Berg, 886 A.2d 980 (N.H. 2005).
“45 C.F.R. §§ 164.500 -.534 (HIPAA Privacy Rules).”
Roland Pushard III v. Riverview Psychiatric Ctr., 2020 ME 23 (Me. 2020).
“Pushard argues that there are genuine issues of material fact regarding whether he is entitled to whistleblower protection based on complaints he made, while employed at Riverview, about (1) Riverview’s staffing policies; (2) his supervisor’s alleged mistreatment of another…”
Wade Loyning v. Neisha Potter & Fern Ridge Counseling, 2024 WY 82 (Wyo. 2024).
· cites it 2× “See 45 C.F.R. §§ 164.500 - 164.535. She also claimed disclosure of the records “would be contrary to the minor child’s best interests and would destroy the safe place that the minor child has established for herself in counseling.”
Wall v. Pahl, 2016 WI App 71 (Wis. Ct. App. 2016).
“30(12) do not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity or its business associate that meets all the following criteria: (a) The covered entity or its business associate makes the use, disclosure, or request for…”
Hill v. East Baton Rouge Par., 925 So. 2d 17 (La. Ct. App. 2005).
“[2] 45 C.F.R. § 164.500 (a). A *22 covered entity is defined in the regulations as (1) a health plan; [3] (2) a health care clearinghouse; [4] or (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by HIPAA.”
Espinoza v. Gold Cross Servs., Inc., 2010 UT App 151 (Utah Ct. App. 2010).
“§§ 13200 to 1820d-9 (2006); see also 45 C.F.R. §§ 164.500 -.534 (2009), Gold Cross overcharged them to produce copies of their medical records.”
King v. Cook Cnty. Health & Hospitals Sys., 2020 IL App (1st) 190925 (Ill. App. Ct. 2020).
“45 C.F.R. § 164.500 et seq. (2016). This complex regulatory scheme, known as the “Privacy Rule,” works to safeguard confidential patient health information.”
King v. Cook Cnty. Health & Hospitals Sys., 2020 IL App (1st) 190925 (Ill. App. Ct. 2020).
“45 C.F.R. § 164.500 et seq. (2016). This complex regulatory scheme, known as the “Privacy Rule,” works to safeguard confidential patient health information.”
Westbury Med. Care, P.C. v. Lumbermans Mut. Ins., 5 Misc. 3d 838 (2004).
““Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information” (45 CFR 164.500 [a]). The plaintiff argues that the defendant is not a “covered entity”…”
Brewer Ex Rel. Leach v. Hunter, 762 S.E.2d 654 (N.C. Ct. App. 2014).
“Because the records being produced pursuant to this Order are subject to the protections of the Health-Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. 164.500, et seq., N.C. Gen. Stat.”
Annotations are extracted automatically from the opinions in the
Syfert caselaw corpus and ranked by authority, recency, and
treatment. Dots show Syfertize treatment of the citing case itself.