Legally separate covered entities that are under common ownership or control and that have all designated themselves as a single affiliated covered entity for the purposes of the Privacy and Security Rule (more precisely, those parts of the Rules appearing at 45 CFR, Part 160, Subparts C and E).
Source(s):
NIST SP 800-66 Rev. 1
from
45 C.F.R., Sec. 164.105(b)