Attached is OCR's response to an inquery concerning the status of Medical Device Companies under The Privacy Rule.  Depending on the situation, a medical device company could be a provider or a business associate.

 

Regards,

ShareHIPAA moderator