If a practice only deals with cash customers, even though it may not transmit HIPAA-covered transactions relating to eligibility, authorizations, and claims, there may be times when patient data is shared with third parties – for example, when a prescription is sent to a lens supplier. In these circumstances, the communication (to a lens supplier) is a HIPAA-covered transaction if it is communicated electronically. Any individually identifiable health information within the communication (name, address, head size, etc.) is also covered by HIPAA. Once one communication (and the data within it) is covered by HIPAA, every communication (and the data within it) is also covered by HIPAA. Therefore, even if a practice only deals with cash customers, it is highly likely it will qualify as a HIPAA Covered Entity.