The rule protects access to individually identifiable health information that is:
- Created or received by a "covered entity" including a health care provider, health plan, or health care clearing house
- That relates to the past, present or future physical or mental health or condition of the individual, or
- That relates to the provision of health care in the past, present or future.