Is a state-run medical marijuana patient registry a covered entity? The Florida registry includes identifiable patient personal information and MMJ "prescription" information that is passed from the physician, to the DOH, to dispensing retail locations. Any physician, law enforcement officer, or retail location employee can find and view any patient's information.
Here is the Florida physician user manual: http://www.flhealthsource.gov/ommu/forms/registry-user-guide-physician.pdf
The Florida DOH, which runs the electronic Medical Marijuana Use Registry (MMUR), insists that it is not a covered entity because marijuana is federally illegal, but I have not been able to find the section in the HIPAA rules that deals with this issue.
If a development company were to integrate with a MMUR (not necessarily the Florida one) would the company be a BA?