< img src=”http://thedatamap.org/map2013/map2013hipaa.jpg";>
 Flows not covered by HIPAA are in bold.
Of the hundreds of flows of personal health data documented on thedatamap, only half are actually covered by the Health Information Portability and Accountability Act (HIPAA). HIPAA governs the sharing of personal health information in the United States, but only applies to those entities involved in the direct billing of patient care. So, HIPAA covers some of the data flows from physicians and hospitals, but not all. A noteworthy exception is Discharge Data, which is authorized by state laws. Hospitals and physicians send a copy of each visit to the state and the state, in turn, often shares the data in ways less protective than HIPAA warrants.
< img src=”http://thedatamap.org/fig2.jpg";>
< img src=”http://thedatamap.org/fig2.jpg “;>
![http://thedatamap.org/map2013/map2013hipaa.jpg"](http://thedatamap.org/map2013/map2013hipaa.jpg"){kind=link}
![http://thedatamap.org/fig2.jpg"](http://thedatamap.org/fig2.jpg"){kind=link}
