---
kind: "section"
citation: "45 C.F.R. § 164.500"
title: "45"
number: "164.500"
heading: "Applicability."
url: "https://uscodex.org/cfr/45/164.500"
---

# §164.500. Applicability.

- (a) Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information.
- (b) Health care clearinghouses must comply with the standards, requirements, and implementation specifications as follows:
  - (1) When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with:
    - (i) Section 164.500 relating to applicability;
    - (ii) [Section 164.501](/cfr/45/164.501.md) relating to definitions;
    - (iii) [Section 164.502](/cfr/45/164.502.md) relating to uses and disclosures of protected health information, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;
    - (iv) [Section 164.504](/cfr/45/164.504.md) relating to the organizational requirements for covered entities;
    - (v) [Section 164.512](/cfr/45/164.512.md) relating to uses and disclosures for which individual authorization or an opportunity to agree or object is not required, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;
    - (vi) [Section 164.532](/cfr/45/164.532.md) relating to transition requirements; and
    - (vii) [Section 164.534](/cfr/45/164.534.md) relating to compliance dates for initial implementation of the privacy standards.
  - (2) When a health care clearinghouse creates or receives protected health information other than as a business associate of a covered entity, the clearinghouse must comply with all of the standards, requirements, and implementation specifications of this subpart.
- (c) Where provided, the standards, requirements, and implementation specifications adopted under this subpart apply to a business associate with respect to the protected health information of a covered entity.
- (d) The standards, requirements, and implementation specifications of this subpart do not apply to the Department of Defense or to any other federal agency, or non-governmental organization acting on its behalf, when providing health care to overseas foreign national beneficiaries.

## Notes

### Amendments

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013]

### Authority

Authority: 42 U.S.C. 1320d-2, 1320d-4, and 1320d-9; sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Authority

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Source

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

### Amendments

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013]