True or False: HIPAA applies only to organizations that have electronic health records.

• A. True
• B. False
• C. It depends on the organization
• D. Only hospitals are covered

Answer: (B)

HIPAA protects patient information regardless of how it’s stored or transmitted. The Privacy Rule covers protected health information in any form—paper, spoken, or electronic—while the Security Rule specifically targets electronic PHI. This means an organization must safeguard PHI and adhere to HIPAA requirements even if it doesn’t use electronic health records. A clinic with paper charts or one that mainly communicates about patients by phone still has to protect PHI and respect patient rights under HIPAA. So the statement is false because HIPAA applies to any organization that handles PHI, not only those with electronic records, and it isn’t limited to hospitals.