AGENDA DATE: 4/6/2016
TITLE:
Title
Designation of the County as a Hybrid Entity Under the Health Insurance Portability and Accountability Act of 1996 and the HIPAA Privacy Rule
BODY
SUBJECT/PROPOSAL/REQUEST: Resolution to designate the County as a hybrid entity under HIPAA
ITEM TYPE: Consent Action Item
STAFF CONTACT(S): Foley, Walker, Eggleston, Gerome, Davis, Blair
PRESENTER (S): N/A
LEGAL REVIEW: Yes
REVIEWED BY: Thomas C. Foley
BACKGROUND: In 1996, the federal government enacted the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires that all “covered entities” must comply with the law as well as its regulations. “Covered entities” include health plans and health care providers that electronically transmit any health information in connection with transactions for which the Department of Health and Human Services has adopted guidelines such as Medicare or Medicaid. If any portion of an entity is a “covered entity”, the entire entity is subject to HIPAA and its regulations unless the entity declares that it is a “hybrid entity”. The “hybrid entity” declaration specifies which portions of an organization are health care components. When an entity declares itself a “hybrid entity”, only its health care components are subject to HIPAA and its regulations.
STRATEGIC PLAN: Operational Capacity: Ensure County government’s ability to provide high quality service that achieves community priorities.
DISCUSSION: The Human Resources Department administers the County’s health plan, and the Fire and Rescue Department electronically bills Medicare and Medicaid for emergency medical vehicle transports. Therefore, Albemarle County is a “covered entity”, and the entire entity is subject to HIPAA and its regulations. All County departments are therefore subject to potential Department of Health and Human Services (DHSS) HIPAA compliance audits and enforcement actions. The adoption of the attached proposed “hybrid entity” resolution (Attachment A), which declares that the County’s Human Resources and Fire and Rescue Departments are the only health care components of the County, would limit potential HIPAA compliance audits and enforcement actions to those departments. Without the “hybrid entity” designation, DHSS may audit or investigate complaints about any County department and its protected health information practices and procedures. The purpose of HIPAA is to protect information related to health care. Other County departments encounter health information on an infrequent basis, and do not provide health care services. Therefore, the resolution’s designation only applies to the Human Resources Department and the Fire and Rescue Department, and other County departments would not be subject to a DHSS HIPAA investigation related to health information and would be exempt from HIPAA audits and enforcement actions.
BUDGET IMPACT: There is no budget impact associated with this request.
RECOMMENDATION:
Recommendation
Staff recommends that the Board adopt the attached Resolution (Attachment A) designating Albemarle County as a hybrid entity pursuant to HIPAA.
ATTACHMENTS:
A - Resolution