400
This protects all individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It applies to all health care plans, health care clearinghouses, and to any health care provider who transmits health information.
What is HIPAA privacy rule