A group of records maintained by a covered entity, and includes an individual’s medical and billing records enrollment, payment, claims adjudication, and case management record systems of a health plan; and other records used by covered entities to make decisions about individuals. For example, a health plan member has right to see records related to denial of payment for a treatment.  Does not have right to examine every actuarial spreadsheet into which her history of payment has contributed if not used to make decisions about her own coverage.

Health care clearinghouses are entities that process or facilitate the processing of health information from nonstandard format or content into standard format or content, or from standard format or content into nonstandard format or content, for another entity. They conduct these functions on behalf of another entity, such as a health plan, so usually act as “business associates” of other covered entities.
They are always conducting these functions on behalf of another entity, such as a health plan, so act as “business associates” of other covered entities.

Health Care Provider

Individually Identifiable Health Information is  defined in the HIPAA statute and the Privacy Rule as any health information, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or to past, present, or future payment for the provision of health care to an individual; and that identifies the individual.

ePHI is not altered or destroyed in an unauthorized manner. A failure to ensure the integrity of PHI could lead to inappropriate treatment due to incomplete or inaccurate information.

A limited data set is comprised of data from which most PHI has been removed, except for dates and geographic information; this information may be used only for research, public health, or health care operations purposes. .  Data recipients must sign a Data Use Agreement stating the information will be used only for the specified purposes, no attempt will be made to re-identify it, and it will not be re-disclosed.

This Privacy Rule standard requires that when using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

Title II, Section 264 of the HIPAA statute required the Secretary of HHS (if Congress did not act) to promulgate final regulations with respect to the privacy of individually identifiable health information (IIHI) that addressed the rights of an individual who is a subject of IIHI and the procedures that should be established for the exercise of such rights. It also required the Secretary to address the uses and disclosures of such information that should be authorized or required.
This requirement resulted in the development of the HIPAA Privacy Rule, which was ultimately published in the Federal Register on December 28, 2000.  The Rule was incorporated into the Code of Federal Regulations in Volume 45, Parts 160 and 164 with compliance generally required in 2003.
Part 160 addresses administrative requirements that apply to both the HIPAA Privacy and Security Rules, including such issues as the preemption of state law, compliance and enforcement, and civil money penalties. 

The Security Rule standards require covered entities to evaluate risks and vulnerabilities in their environments in order to implement safeguards that will protect against threats or vulnerabilities and ensure confidentiality, availability, and integrity of ePHI The selection of safeguards that are “reasonable and appropriate” is based on the covered entity’s analysis of risks. Although the Security Rule allows covered entities to implement safeguards that are "reasonable and appropriate" based on the risk analysis, this allowance is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of the Security Rule. Failure to implement safeguards that address the covered entity’s risk analysis could result in violations of the Security Rule, which would be subject to SAG enforcement.

The HIPAA Security Rule is meant to complement the HIPAA Privacy Rule in protecting ePHI. It defines three types of security safeguards—administrative, physical, and technical. Covered entities are required to implement certain safeguards to protect their information systems and the ePHI they contain against anticipated threats and vulnerabilities, and to prevent unauthorized access to or disclosure of ePHI.