"The answer depends upon where the information came from, who has it now, and why they have it. The privacy rules only apply to 'covered entities' -- that is, health plans, health care clearinghouses, and health care providers that transmit health information in electronic form in connection with any of the transactions covered by the HIPAA administrative simplification regulations.... [I]nformation that an employer uses or discloses in performing plan administration functions is affected by the privacy rules."  MORE >>