ABSTRACT
See 45 CFR § 160.103 for the complete denition. If your organization processes or facilitates the processing of health
information from nonstandard format or content into standard format or content, or from standard format or content into nonstandard format or content, then you are likely a health care clearinghouse, and also a covered entity (CE) subject to HIPAA requirements. Unlike health care providers and plans, though, health care clearinghouses do not have to develop a Notice of Privacy Practices if the only protected health information (PHI) they create or receive is as a business associate (BA) of another CE.
