The Social Security Administration (SSA) is not a covered entity. The collection of individually identifiable health information is not a factor in determining whether an entity is a covered entity. Covered entities are defined in HIPAA; they are

  1. health plans,
  2. health care clearinghouses, and
  3. health care providers that transmit any health information in electronic form in connection with a transaction covered in the HIPAA Transactions Rule.

SSA meets none of these criteria as defined at 45 CFR 160.103 (GPO).