The privacy rule, which became effective last October 15, applies to "covered entities" that conduct certain financial and administrative functions electronically. These entities include health care professionals, health plans, hospitals, insurers, and health care information clearinghouses.