HHS classification facts
HHS publishes the definitions. Cite 45 CFR 160.103.
- A covered entity (CE) is a health plan, a clearinghouse, or a provider that does standard electronic transactions.
- A business associate (BA) handles PHI for a CE.
- If an entity is neither, HHS says the HIPAA Rules do not apply.
Do not conclude which box SUAS is in.
HHS pages:
Observed facts
Do not treat this list as a legal class.
- zer0state builds SUAS. Legal entity on this site: Zero State LLC, 30 N Gould St Ste R, Sheridan, WY 82801. Email zer0state@zer0state.com. The Wyoming address is a registered-agent mailing, not an operations claim.
- This Pages site is a poster. Operations are not live. Status: SPEC-017 · NOT READY.
- Intended later use (not authorized): identified opt-in veteran coordination (Check-In, Support Signal in fixture or disabled mode, QRF / Support Case). SUAS is not an EHR. It does not diagnose. It does not predict suicide. It does not call 911. It is not a VA health API. It is not Medi-Cal billing.
- Specs name a Santa Clara County 25–50 veteran pilot. That pilot is not authorized. D-008 and D-013 are open.
- Product rules already specified (not a HIPAA conclusion): TLS; database and backup encryption (key management is open); role and tenant isolation; privileged MFA; audit events; minimization; consent at use time; no production data in development environments; UI forbids compliance-claim strings.
- D-007 retention durations are not decided. This page does not invent a number of days.
- Vendors for host, auth, SMS, email, and production database are not selected (D-001–D-005).
- Do not execute a BAA as if HIPAA applies until D-006 closes. Written data-processing terms with vendors are an operational control, not a legal class.
Ask of counsel
Classify SUAS as one of the following:
- Covered entity (CE)
- Business associate of a named covered entity
- Neither
- Evidence insufficient
If counsel later records that HIPAA applies
This section is not in force now.
If counsel later records that HIPAA applies:
- Business associate agreements for relevant vendors
- Security Rule risk analysis and policies
- Breach-notice counsel
- If SUAS is a covered entity: a Notice of Privacy Practices and an individual-rights process
This sheet does not name a statutory deadline.
42 CFR Part 2
42 CFR Part 2 stays out of scope unless substance-use-disorder (SUD) treatment records are later specified.
Status of this sheet
Last updated 26 Aug 2026 PT.
This is a draft for counsel. It is not legal advice. It is not a certification. D-006 remains pending. SPEC-017 remains NOT READY. UI_CONFORMANCE remains NOT READY. SPEC-018 remains NOT READY. The PRIVACY gate remains NOT_READY. No readiness gate advances because this sheet exists.