Adopt resolution designating Yolo County as a Hybrid Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). (No general fund impact) (Sullivan)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law regulating the protection, accessibility, and use of individuals’ health information. These regulations apply to all qualifying healthcare services and administrative functions. Any healthcare provider, health plan, or healthcare clearinghouse who furnishes these covered services are considered a “covered entity” under HIPAA. Due to the nature of services provided by certain County departments and programs, Yolo County is considered a covered entity.
 

HIPAA regulations allow for covered entities to be designated as a “hybrid entity.” For non-hybrid covered entities, every component and service provided by the entity is subject to regulations under HIPAA. In contrast, hybrid entities are able to designate covered and non-covered components, with only the covered components being subject to the regulations. This provides a major benefit as departments and programs that do not engage in covered healthcare services will not be unnecessarily burdened by restrictions under HIPAA (it should be noted that the services may still be subject to other privacy and security regulations). Thus, it is recommended that the Board designate Yolo County as a hybrid entity.

Under HIPAA, hybrid covered entities must define and designate its health care components. The Health and Human Services Agency has completed a first phase identification of programs that should be included in the health care component. This analysis was accomplished through surveys of program staff, key informant interviews, and determinations by subject matter experts. It is recommended that all other County Departments be directed to further identify other programs and services which should be included in the health care component and that each should collaborate to create unified privacy and security related policies and procedures to comply with HIPAA.