The Social Security Administration (SSA) is not a covered entity. The collection of individually identifiable health information is not a factor in determining whether an entity is a covered entity. Covered entities are defined in HIPAA; they are
- health plans,
- health care clearinghouses, and
- health care providers that transmit any health information in electronic form in connection with a transaction covered in the HIPAA Transactions Rule.
SSA meets none of these criteria as defined at 45 CFR 160.103 (GPO).