Relevancy of HIPAA to civilian government agency

This can be a complicated issue, so I understand your concerns. It sounds like your organization could fall in the categories of a health care provider or business associate, but you may not be considered a HIPAA covered entity at all. You say that you do not gather patient names or social security numbers. Do you gather any other information from the patients? HIPAA specifies that any information that identifies or can be reasonably used to identify an individual such as name, address, social security number, phone and fax numbers, medical record numbers, e-mail addresses, URLs, IP addresses, etc. is covered under the rules. In a nutshell, if you gather this type of information and store it or transmit it electronically, then your organization is most likely considered a HIPAA covered entity. Otherwise, you should be in the clear.