Records about an individual who is (or seeks or sought to become) a member of the uniformed services, employee of the U.S. Government, employee of a DOD contractor, or person with a comparable relationship to the DOD, that are maintained by a DOD Component or other entity subject to this issuance.  A more detailed definition is provided in DODM 6025....

The HIPAA Rule governing the use and disclosure of PHI held by covered entities and business associates.

In the case of a health plan administered by DOD, the DOD Component (or subcomponent) functions as the administrator of the health plan.  To the extent this issuance prescribes duties to be performed by covered entities, the term refers only to DOD covered entities.  All covered entities within the Military Health System (including both health p...

All DOD health plans and all DOD health care providers that are, in the case of institutional providers, organized in accordance with the management authority of, or in the case of covered individual providers, assigned to or employed by, the DHA, the Surgeon General of the Army, the Surgeon General of the Navy, or the Surgeon General of the Air Force.

The rules and instructions issued by HHS pursuant to Section 264(c) of HIPAA and captioned the HIPAA Privacy, Security, Breach, and Enforcement Rules (see the References). This term does not include the HIPAA transaction, code set, and identifier rules in Part 162 of Title 45, Code of Federal Regulations.

Current DOD issuances and other federal law relating to electronic data security and protection of DOD information systems.  A more detailed definition is provided in DODM 6025.18.

A health plan, or a health care provider who transmits any health information in electronic form in connection with a standard transaction pursuant to Part 162 of Title 45, Code of Federal Regulations.  A more detailed definition is provided in DODM 6025.18.

Individually identifiable health information that is transmitted or maintained by electronic or any other form or medium. PHI excludes individually identifiable health information in employment records held by a DOD covered entity in its role as employer. Information which has been de-identified in accordance with Paragraph 4.5.a is not PHI. PHI is a subs...

Each authority of the U.S. Government, whether or not it is within or subject to review by another agency.

Federal agency or any unit of State or local government.

Any MTF, including garrison clinics and such facilities in a military operational unit, ship, or aircraft, and any other person or organization outside of such facilities’ workforce who furnishes, bills, or is paid for health care in the normal course of business. This term includes occupational health clinics for civilian employees or contractor pe...

Any of the following activities of the covered entity to the extent that the activities are related to covered functions: Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, if obtaining general knowledge is not the primary purpose of any studies resulting from such activitie...

Any information, including genetic information, in any form or medium, that: Is created or received by a health care provider, health plan, public health authority, employer, life insurer, or school or university. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual;...

Any DOD program that provides or pays the cost of health care, unless exempted under this definition of health plan. The following components of the TRICARE Program are a health plan under this issuance

• The program that provides health care under the authori...

A breach as defined in Section 164.402 of the HIPAA Breach Rule. The text of that HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI. HHS breach excludes: Any unintentional acquisitio...