Like all Administrative Simplification rules, the Security rule is applicable to health plans, health care clearinghouses, and to any health care provider transmitting health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”).