any of the following activities of a covered entity that relate to its covered functions (i.e., acting as a health care provider and an employer group health plan): conducting quality assessment and improvement activities; reviewing the competence or qualifications of health care professionals; underwriting (except as prohibited when involving genetic information), premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits; conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; business planning and development; and business management and general administrative activities of the entity.
