HIPAA does not require everyone to comply with its rules. Only those entities that HIPAA considers a "covered entity" are capable of such a violation. "Covered entities" include healthcare providers, health plans, and healthcare clearinghouses.The following entities are generally required to comply with HIPAA, and can therefore be investigated for a violation by OCR:Doctors, psychologists, chiropractors, dentists.
Hospitals, clinics, nursing homes, pharmacies.
Health-insurance companies, company health plans.
Government healthcare programs such as Medicaid or Medicare.
 Just as there are certain entities that are covered by HIPAA's provisions, there are those that are not bound by its rules and therefore incapable of violating them. OCR will not investigate a complaint filed against the following entities:Employers, life insurers, workers' compensation carriers.
Many schools/school districts.
Many state agencies, such as those dealing with child-protective services.
Many law-enforcement agencies.
Many municipal offices.
 The HIPAA Privacy Rule protects your privacy by regulating who is allowed to see or receive your healthcare information. The HIPAA Security Rule requires any covered entity that stores your healthcare information in electronic form to have taken the appropriate security measures to protect that information from unauthorized access.The following information is protected under HIPAA:Information placed into your medical record by a healthcare provider.
Conversations your doctor has with other healthcare professionals regarding your care or treatment.
Billing information at your clinic and personal information held by your health insurer.
 HIPAA requires covered entities to put in place certain measures and take certain action to ensure that your healthcare information is protected from unauthorized access or disclosure. Specifically, such an entity must do the following:Establish safeguards to protect your health information and not use/disclose your health information in an improper way.
Limit use and disclosure of your health information to only that which is necessary.
Establish procedures to limit access to your health information.
Train employees on how to protect your health information.
 HIPAA also gives each individual certain rights over their own healthcare information. Any covered entity must respect and comply with these rights. These rights include:Asking to view/obtain a copy of your health records.
Having your health records corrected as appropriate.
Receiving a notice regarding how your health information is used/shared, and getting a report detailing when/why your health information was used/shared.
Deciding if your health information can be shared for other purposes, such as marketing.
File a complaint against a "covered entity.",
Know who you cannot report.
Know what information is protected.
Know what covered entities are required to do to protect your information.
Know your rights.
{"src": "wikihow-all_test", "title": "How to Report HIPAA Violations3"}