(a) The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. §§ 1320d et seq., requires entities that perform certain health care functions to comply with regulations related to the use, disclosure, and security of individually identifiable health information.
(b) HIPAA permits a single legal entity that is engaged in both covered health care functions and non-covered functions to designate itself a “Hybrid Entity.” To become a Hybrid Entity, the single legal entity must identify and designate as health care components those departments or divisions of the entity that perform 1) covered health care functions or 2) activities that involve the use or disclosure of protected health information on behalf of another department or division thereof that performs covered health care functions. Once the single legal entity makes a Hybrid Entity designation, HIPAA and its implementing regulations apply only to those components of the entity that are designated as health care components, and do not apply to the remainder of the entity.
