{"id":97432,"date":"2001-11-19T00:00:00","date_gmt":"2001-11-19T05:00:00","guid":{"rendered":"https:\/\/beta.pewresearch.org\/pewresearch-org\/2001\/11\/19\/part-3-covered-web-sites\/"},"modified":"2024-04-14T04:14:31","modified_gmt":"2024-04-14T09:14:31","slug":"part-3-covered-web-sites","status":"publish","type":"post","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-3-covered-web-sites\/","title":{"rendered":"Part 3: Covered Web Sites"},"content":{"rendered":"

Providers and Insurers<\/h3>\n\n

The privacy rule covers health plans and health care providers that transmit health information electronically in a standard format.[36.numoffset=”36″ Health care clearinghouses are covered entities under the regulation. However, as a practical matter, whether a clearinghouse is a covered entity would be irrelevant to most consumers, since they do not generally have direct contact with them. See discussion on business associates infra Part IV.B.] Once an entity is a \u201ccovered entity,\u201d it is subject to the new regulation whether it is conducting business on or offline. <\/p>\n\n

It should be fairly easy to tell whether a health plan is a covered entity.\u00a0 The term \u201chealth plan\u201d is broadly defined in the regulation and covers just about anyone that provides or pays the cost of medical care.\u00a0 It covers fee-for-service insurers, HMOs, Medicare and Medicaid programs, issuers of long-term care policies, group health plans and others.\u00a0 Given this broad definition, it is fairly likely that a Web site hosted by a health insurer or HMO will be a covered health plan under the regulation.<\/p>\n\n

Aetna U.S. Healthcare, for example, is a covered health plan with a Web site[37. http:\/\/www.aetna.com\/members\/index.html<\/a>.] that allows members to view their personal health information, check the status of a claim, make changes in primary care physicians, and seek replacements of ID cards.\u00a0 The information collected and maintained by the site would be covered by the regulation. <\/p>\n\n

It will be more difficult for consumers to tell whether any given provider is subject to the regulation, since not all health care providers fall under the definition of \u201ccovered entity.\u201d\u00a0 To determine whether a person or organization is a covered provider under the privacy rule, a consumer would need to answer three key questions: <\/p>\n\n

    \n
  1. Is the person or organization a health care provider as defined by the rule?<\/li>\n
  2. Do they transmit health information in connection with one of the financial or administrative \u201cstandard transactions\u201d listed in HIPAA?<\/li>\n
  3. Do they transmit that information electronically in the required \u201cstandard format\u201d?<\/li>\n<\/ol>\n\n

    A provider is only covered by the privacy rule if the answer to all<\/i> of these questions is \u201cyes.\u201d\u00a0 Answering even the simplest of these questions, however, may not be as easy as it appears.<\/p>\n\n

    As defined in the privacy rule, the term \u201chealth care provider\u201d covers most of the people and organizations that consumers traditionally think of as providers.\u00a0 It includes any person who furnishes, bills or is paid for health care in the normal course of business.\u00a0 Thus doctors, counselors, clinics, hospitals, nurses and similar persons and organizations are, not surprisingly, considered to be health care providers under the regulation. <\/p>\n\n

    As for those who furnish health-related supplies, the rule applies only<\/i> to those who sell or dispense these items pursuant to a prescription<\/i>.[38. The privacy rule applies to providers of health care. The rule defines \u201chealth care\u201d as including the sale or dispensing of a drug, device or other equipment, or item in accordance with a prescription. Privacy Rule, \u00a7 160.103, available at http:\/\/www.hhs.gov\/ocr\/regtext.html<\/a>. \u201cHealth care\u201d therefore does not include over-the-counter drugs.] Under this requirement, a pharmacist, such as CVS, is a health care provider, while a Web site that sells books and tapes on losing weight, such as eDiets.com, is not.\u00a0 Similarly, a pharmaceutical company is not a health care provider since it does not sell or dispense drugs pursuant to a prescription.<\/p>\n\n

    If a person or an organization is a \u201chealth care provider\u201d under the regulation, the next question to ask is whether it engages in the type of \u201cstandard transactions\u201d that will bring it within the scope of the privacy rule.\u00a0 Since the intent of the administrative simplification provisions of HIPAA (including the privacy rule) is to simplify the processing of health insurance claims, the privacy rule applies only to providers who conduct insurance related transactions.\u00a0 Some of the electronic transactions that trigger application of HIPAA to a provider include: submitting health claims or equivalent information related to physician-patient interactions; determining eligibility for a health plan; receiving health care payment and remittance advice; and receiving referral certification and authorization.\u00a0 All of these transactions are related to health insurance-type transactions.<\/p>\n\n

    In a very general sense, this question can be boiled down to: \u201cDoes the provider accept health insurance (including Medicaid) or participate in an HMO?\u201d\u00a0 If the answer to this question is yes, it is likely that the provider will engage in the type of standard transactions necessary to bring her within the scope of the privacy rule.<\/p>\n\n

    Even if a provider does engage in standard transactions, that still leaves the last, and perhaps the most difficult, question to answer: \u201cDoes the health care provider transmit information in relation to these standard transactions electronically in the required standard format?\u201d\u00a0 <\/b>If a provider transmits health information electronically in relation to any of these standard transactions, such as verifying insurance coverage or filing a health claim, HIPAA requires the provider to use a standard electronic format (i.e.<\/i>, the provider must include certain information and use specified codes for diagnosis and treatment).[39. See supra<\/em> note 16.]\u00a0 Currently, October 2002 is the deadline for compliance with the requirement for adopting the standard format.\u00a0 HHS has taken the position that only providers who actually use the required format are covered by the privacy rule.<\/p>\n\n

    If a provider has an online presence and accepts insurance, it probably will be safe to assume that she transmits the required type of information electronically.\u00a0 But how a consumer is to determine whether a provider uses the standard format is problematic. <\/p>\n\n

    It becomes apparent how difficult it is to know whether a provider is covered when the test is applied to an actual site \u2013 for example, PatientSite,[40. http:\/\/patientsite.caregroup.org\/default.asp<\/a>.] a Web site created by CareGroup HealthCare System, a network of six hospitals in Massachusetts.\u00a0 PatientSite allows patients to communicate with their physicians through the Web.\u00a0 These electronic communications become part of the patient\u2019s medical record.\u00a0 In addition, the site allows patients to check insurance benefits, refill prescriptions, request referrals, review lab results and make appointments.\u00a0 Notably, these are online health care activities that the provider already conducts offline.\u00a0 But is PatientSite run by a health care provider covered by the privacy regulation?<\/p>\n\n

    The answer is \u201cmaybe.\u201d\u00a0 PatientSite appears to be directly operated by a network of hospitals that clearly would be health care providers under the regulation.\u00a0\u00a0 Additionally, the providers accept insurance.\u00a0 Its status as a covered entity, however, is not definitive \u2013 it is not clear from the Web site if or when CareGroup will use the standard format that is required in order to be covered by the privacy rule.\u00a0 Currently, providers do not have to use the standard format until October 2002, and there has been extensive lobbying to extend that date.\u00a0 It is only once a provider meets all three of the required criteria that it becomes a covered entity, and the information collected at its site would be protected by the regulation. <\/p>","protected":false},"excerpt":{"rendered":"

    Providers and Insurers The privacy rule covers health plans and health care providers that transmit health information electronically in a standard format.[36.numoffset=”36″ Health care clearinghouses are covered entities under the regulation. However, as a practical matter, whether a clearinghouse is a covered entity would be irrelevant to most consumers, since they do not generally have […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"sub_headline":"","sub_title":"","_prc_public_revisions":[],"_ppp_expiration_hours":0,"_ppp_enabled":false,"ai_generated_summary":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"apple_news_api_id":"","apple_news_api_revision":"","apple_news_api_created_at":"","apple_news_api_modified_at":"","apple_news_api_share_url":"","apple_news_api_pending":"","apple_news_is_preview":false,"apple_news_is_hidden":false,"relatedPosts":[],"reportMaterials":[],"multiSectionReport":[],"package_parts__enabled":false,"package_parts":[],"datacite_doi":"","datacite_doi_citation":"","_prc_seo_qr_attachment_id":0,"spoken_article_player_enabled":true,"displayBylines":true,"footnotes":"","prc_watchers":[],"_prc_fork_parent":0,"_prc_fork_status":"","_prc_active_fork":0,"jetpack_post_was_ever_published":false},"categories":[],"tags":[],"bylines":[],"collection":[],"datasets":[],"level_of_effort":[],"primary_audience":[],"information_type":[],"_post_visibility":[],"formats":[458],"_fund_pool":[],"languages":[],"regions-countries":[],"research-teams":[526],"workflow-status":[],"class_list":["post-97432","post","type-post","status-publish","format-standard","hentry","formats-report","research-teams-internet"],"label":false,"post_parent":97396,"word_count":1167,"canonical_url":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-3-covered-web-sites\/","art_direction":false,"_embeds":[],"watchers":[],"table_of_contents":[{"id":97396,"title":"Exposed Online: The federal health privacy regulation and Internet user impacts","slug":"exposed-online-the-federal-health-privacy-regulation-and-internet-user-impacts","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/exposed-online-the-federal-health-privacy-regulation-and-internet-user-impacts\/","is_active":false},{"id":97403,"title":"About Us","slug":"about-us-4","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/about-us-4\/","is_active":false},{"id":97409,"title":"The Terrain","slug":"the-terrain","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/the-terrain\/","is_active":false},{"id":97416,"title":"Part 1: Public Opinion","slug":"part-1-public-opinion","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-1-public-opinion\/","is_active":false},{"id":97423,"title":"Part 2: The New Federal Health Privacy Regulation","slug":"part-2-the-new-federal-health-privacy-regulation","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-2-the-new-federal-health-privacy-regulation\/","is_active":false},{"id":97432,"title":"Part 3: Covered Web Sites","slug":"part-3-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-3-covered-web-sites\/","is_active":true},{"id":97438,"title":"Part 4: Partially Covered and Indirectly Covered Web Sites","slug":"part-4-partially-covered-and-indirectly-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-4-partially-covered-and-indirectly-covered-web-sites\/","is_active":false},{"id":97444,"title":"Part 5: Web Sites Not Covered","slug":"part-5-web-sites-not-covered","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-5-web-sites-not-covered\/","is_active":false},{"id":97447,"title":"Part 6: Putting It All Together","slug":"part-6-putting-it-all-together","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-6-putting-it-all-together\/","is_active":false},{"id":97454,"title":"Part 7: Conclusion","slug":"part-7-conclusion","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-7-conclusion\/","is_active":false}],"report_materials":"","report_pagination":{"current_post":{"id":97432,"title":"Part 3: Covered Web Sites","slug":"part-3-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-3-covered-web-sites\/","is_active":true,"page_num":6},"next_post":{"id":97438,"title":"Part 4: Partially Covered and Indirectly Covered Web Sites","slug":"part-4-partially-covered-and-indirectly-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-4-partially-covered-and-indirectly-covered-web-sites\/","is_active":false,"page_num":7},"previous_post":{"id":97423,"title":"Part 2: The New Federal Health Privacy Regulation","slug":"part-2-the-new-federal-health-privacy-regulation","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-2-the-new-federal-health-privacy-regulation\/","is_active":false,"page_num":5},"pagination_items":[{"id":97396,"title":"Exposed Online: The federal health privacy regulation and Internet user impacts","slug":"exposed-online-the-federal-health-privacy-regulation-and-internet-user-impacts","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/exposed-online-the-federal-health-privacy-regulation-and-internet-user-impacts\/","is_active":false,"page_num":1},{"id":97403,"title":"About Us","slug":"about-us-4","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/about-us-4\/","is_active":false,"page_num":2},{"id":97409,"title":"The Terrain","slug":"the-terrain","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/the-terrain\/","is_active":false,"page_num":3},{"id":97416,"title":"Part 1: Public Opinion","slug":"part-1-public-opinion","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-1-public-opinion\/","is_active":false,"page_num":4},{"id":97423,"title":"Part 2: The New Federal Health Privacy Regulation","slug":"part-2-the-new-federal-health-privacy-regulation","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-2-the-new-federal-health-privacy-regulation\/","is_active":false,"page_num":5},{"id":97432,"title":"Part 3: Covered Web Sites","slug":"part-3-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-3-covered-web-sites\/","is_active":true,"page_num":6},{"id":97438,"title":"Part 4: Partially Covered and Indirectly Covered Web Sites","slug":"part-4-partially-covered-and-indirectly-covered-web-sites","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-4-partially-covered-and-indirectly-covered-web-sites\/","is_active":false,"page_num":7},{"id":97444,"title":"Part 5: Web Sites Not Covered","slug":"part-5-web-sites-not-covered","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-5-web-sites-not-covered\/","is_active":false,"page_num":8},{"id":97447,"title":"Part 6: Putting It All Together","slug":"part-6-putting-it-all-together","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-6-putting-it-all-together\/","is_active":false,"page_num":9},{"id":97454,"title":"Part 7: Conclusion","slug":"part-7-conclusion","link":"https:\/\/beta.pewresearch.org\/pewresearch-org\/internet\/2001\/11\/19\/part-7-conclusion\/","is_active":false,"page_num":10}]},"parent_info":{"parent_title":"Exposed Online: The federal health privacy regulation and Internet user impacts","parent_id":97396},"materialsOrdered":[],"chaptersOrdered":[],"partsOrdered":[],"partsEnabled":false,"datacite_doi":"","prc_seo_data":{"title":"Part 3: Covered Web Sites","description":"Providers and Insurers The privacy rule covers health plans and health care providers that transmit health information electronically in a standard format.[36.numoffset=\"36\" Health care clearinghouses are covered entities under the…","og_title":"Part 3: Covered Web Sites","og_description":"","schema_type":"Article","noindex":false,"canonical_url":"","primary_terms":[],"custom_schema":[],"og_image":0,"indexnow_submitted_at":null,"gsc_index_status":null},"prepublish_checks":{"prc-image-alt-text":{"status":"complete","message":"No image blocks in content.","data":null},"prc-about-this-research":{"status":"incomplete","message":"Add an \"About this research\" details block.","data":null},"prc-paragraph-count":{"status":"complete","message":"Found 13 paragraphs.","data":{"count":13}},"prc-internal-link":{"status":"incomplete","message":"Add at least one internal link.","data":{"count":0}}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"relatedPostsOrdered":[],"bylinesOrdered":[],"acknowledgementsOrdered":[],"_links":{"self":[{"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/posts\/97432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/comments?post=97432"}],"version-history":[{"count":2,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/posts\/97432\/revisions"}],"predecessor-version":[{"id":134131,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/posts\/97432\/revisions\/134131"}],"wp:attachment":[{"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/media?parent=97432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/categories?post=97432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/tags?post=97432"},{"taxonomy":"bylines","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/bylines?post=97432"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/collection?post=97432"},{"taxonomy":"datasets","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/datasets?post=97432"},{"taxonomy":"level_of_effort","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/level_of_effort?post=97432"},{"taxonomy":"primary_audience","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/primary_audience?post=97432"},{"taxonomy":"information_type","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/information_type?post=97432"},{"taxonomy":"_post_visibility","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/_post_visibility?post=97432"},{"taxonomy":"formats","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/formats?post=97432"},{"taxonomy":"_fund_pool","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/_fund_pool?post=97432"},{"taxonomy":"languages","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/languages?post=97432"},{"taxonomy":"regions-countries","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/regions-countries?post=97432"},{"taxonomy":"research-teams","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/research-teams?post=97432"},{"taxonomy":"workflow-status","embeddable":true,"href":"https:\/\/beta.pewresearch.org\/pewresearch-org\/wp-json\/wp\/v2\/workflow-status?post=97432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}