§ 22H.4. DESIGNATION OF COVERED ENTITIES AND BUSINESS ASSOCIATES; REPORTS.
Latest version.
This Chapter 22H shall be administered by the City Administrator, who shall have the following responsibilities:
(a) Within one month of the effective date of this Chapter 22H, and not less than every three years thereafter, the City Administrator shall issue a report identifying every City department and/or division thereof that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity. This report shall be prepared in consultation with the City Attorney, based on a review of the functions performed by City departments and divisions thereof.
(b) If, prior to the deadline for issuance of the second or subsequent reports required by subsection (a), a new City department or division is established that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity, or the function(s) of existing City departments or divisions change in a way that would alter the existing designation of Health Care Components approved by the Board of Supervisors referenced in subsection (c), the City Administrator shall submit to the Board of Supervisors an interim report identifying every City department and/or division thereof that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity.
(c) Upon issuing a report referenced in subsection (a) or (b), the City Administrator shall submit the report to the Board of Supervisors, accompanied by a proposed resolution to accept the report and to designate as Health Care Components the City departments and/or divisions thereof that would meet the definition of a Covered Entity or Business Associate if they were separate legal entities. In making this designation, the Board is not bound by the City Administrator’s report.
(d) The City Administrator shall publish on the City Administrator’s website an up-to-date list of the City departments and/or divisions thereof that are designated as Health Care Components by resolution of the Board of Supervisors in accordance with subsection (c).
(e) The City Administrator shall retain documentation of each report issued pursuant to subsection (a) or (b) and submitted to the Board of Supervisors under subsection (c), for six years from the date of its submission.
(f) The City Administrator shall develop, maintain, and administer a citywide HIPAA compliance policy concerning the use and disclosure of Protected Health Information in compliance with HIPAA and its implementing regulations. Each City department that is designated as a Health Care Component, or that operates a division or program that is designated as a Health Care Component, shall be responsible for developing policies and procedures relevant to its specific HIPAA compliance responsibilities, subject to the approval of the City Administrator, if the City Administrator imposes an approval requirement on some or all affected departments.
