The primary function of 鶹Ӱ to provide education to under鶹Ӱ and 鶹Ӱ students. Because it is not a primary function of 鶹Ӱ to provide health care, 鶹Ӱ is permitted to designate itself as a “hybrid entity,” which allows it to apply the HIPAA Privacy and Security Rule only to those parts of 鶹Ӱ that are “HIPAA Health Care Components.” A HIPAA Health Care Component is a component of the single legal entity that would meet the definition of a HIPAA Covered Entity if it were a separate entity; or a department within the Hybrid Entity that accesses Protected Health Information of a department that is a Health Care Component for the purpose of providing services to the Health Care Component. As a hybrid entity, 鶹Ӱ must identify in writing its Health Care Components.
Health Care Components at 鶹Ӱ are the:
- All specialty health care clinics operated by or on behalf of 鶹Ӱ including, but not limited to, Pacific EyeClinics, Pacific Psychology Clinics, Pacific EarClinic, Pacific Dental Health Clinic, Pacific Interprofessional Diabetes Clinics, Pacific Pharmacotherapy Clinic, Student Health Center and Pacific Interprofessional Clinic but not including the Student Counseling Center or the Sports Medicine Clinic.
- Information Technology Services, to the extent any personnel use and disclose individually identifiable health information in providing administrative and support services to the specialty health care clinics or self-funded group health plans, and would constitute a business associate if the department was a separate legal entity.
- Business Office, to the extent any personnel use and disclose individually identifiable health information in providing administrative and support services to the specialty health care clinics or self-funded group health plans, and would constitute a business associate if the department was a separate legal entity.
- Legal Affairs, to the extent any personnel use and disclose individually identifiable health information in providing administrative and support services to the specialty health care clinics or self-funded group health plans, and would constitute a business associate if the department was a separate legal entity.
- All self-funded group health plans and the Human Resources department to the extent that it performs covered functions as the administrator of the selffunded group health plans that 鶹Ӱ makes available to its employees.
All departments or components of 鶹Ӱ that are not specifically identified above are excluded from the Health Care Components including, but not limited to, the following:
- 鶹Ӱ Student Counseling Center, which exclusively provides services for 鶹Ӱ Students
- Sports Medicine Clinic, which exclusively provides services for 鶹Ӱ Students
- Office of Scholarship and Sponsored Projects
The privacy of the records maintained by the Student Counseling Center and Sports Medicine Clinic are governed by the Family Educational Rights and Privacy Act (FERPA) as “education records” or “treatment records” and are expressly excluded from coverage under the HIPAA Privacy and Security Rules.
This document serves as the written designation of the Health Care Components of 鶹Ӱ required by 45 C.F.R 164.504(c)(3)(iii). This revised designation shall become effective as of July 13, 2021 and supersedes the previous designation that took effect January 28, 2014.