Martha Sewell, one of my partners at KS, reminded me of a growing issue for on-site medical clinics.  Currently, on-site medical clinics are a HIPAA excepted benefit and the clinic itself is excepted from HIPAA privacy.  However, HHS has never formally defined an on-site medical clinic.  Many of us have thought that the exception may only apply to traditional on-site clinics, and not the large on-site clinics that are established by employers today that are close to fully functional medical offices.  I recently had a chance to discuss this issue with HHS and unofficially HHS indicated that it may change this rule in the future.  If this rule is changed, it would limit the on-site clinic exception in the HIPAA privacy rules to only clinics that handle workplace emergencies and related issues.