--- title: "45 CFR 164.500 HIPAA: Applicability" canonical: "https://dposchool.com/hipaa/section/164.500" source: "https://www.ecfr.gov/current/title-45/section-164.500" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.500 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart E: Privacy of Individually Identifiable Health Information # 45 CFR 164.500 HIPAA: Applicability eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.500(a) **(a)** Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information. ### 45 CFR 164.500(b) **(b)** Health care clearinghouses must comply with the standards, requirements, and implementation specifications as follows: #### 45 CFR 164.500(b)(1) **(1)** When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with: ##### 45 CFR 164.500(b)(1)(i) **(i)** Section 164.500 relating to applicability; ##### 45 CFR 164.500(b)(1)(ii) **(ii)** Section 164.501 relating to definitions; ##### 45 CFR 164.500(b)(1)(iii) **(iii)** Section 164.502 relating to uses and disclosures of protected health information, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information; ##### 45 CFR 164.500(b)(1)(iv) **(iv)** Section 164.504 relating to the organizational requirements for covered entities; ##### 45 CFR 164.500(b)(1)(v) **(v)** Section 164.512 relating to uses and disclosures for which individual authorization or an opportunity to agree or object is not required, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information; ##### 45 CFR 164.500(b)(1)(vi) **(vi)** Section 164.532 relating to transition requirements; and ##### 45 CFR 164.500(b)(1)(vii) **(vii)** Section 164.534 relating to compliance dates for initial implementation of the privacy standards. #### 45 CFR 164.500(b)(2) **(2)** When a health care clearinghouse creates or receives protected health information other than as a business associate of a covered entity, the clearinghouse must comply with all of the standards, requirements, and implementation specifications of this subpart. ### 45 CFR 164.500(c) **(c)** Where provided, the standards, requirements, and implementation specifications adopted under this subpart apply to a business associate with respect to the protected health information of a covered entity. ### 45 CFR 164.500(d) **(d)** The standards, requirements, and implementation specifications of this subpart do not apply to the Department of Defense or to any other federal agency, or non-governmental organization acting on its behalf, when providing health care to overseas foreign national beneficiaries. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013\] [45 CFR 164.500 on eCFR](https://www.ecfr.gov/current/title-45/section-164.500) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.500 Previous: [45 CFR 164.414 HIPAA: Administrative requirements and burden of proof](https://dposchool.com/hipaa/section/164.414) Next: [45 CFR 164.501 HIPAA: Definitions](https://dposchool.com/hipaa/section/164.501) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents