Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Covered functions.


We add a new term, "covered functions," as a shorthand way of expressing and referring to the functions that the entities covered by section 1172(a) of the Act perform. Section 1171 defines the terms "health plan", "health care provider", and "health care clearinghouse" in functional terms. Thus, a "health plan" is an individual or group plan "that provides, or pays the cost of, medical care...", a "health care provider" "furnish[es] health care services or supplies," and a "health care clearinghouse" is an entity "that processes or facilitates the processing of ... data elements of health information...". Covered functions, therefore, are the activities that any such entity engages in that are directly related to operating as a health plan, health care provider, or health care clearinghouse; that is, they are the functions that make it a health plan, health care provider, or health care clearinghouse.

The term "covered functions" is not intended to include various support functions, such as computer support, payroll and other office support, and similar support functions, although we recognize that these support functions must occur in order for the entity to carry out its health care functions. Because such support functions are often also performed for parts of an organization that are not doing functions directly related to the health care functions and may involve access to and/or use of protected health information, the rules below describe requirements for ensuring that workforce members who perform these support functions do not impermissibly use or disclose protected health information. See § 164.504.