City of Sacramento
City Council - 5PM Report
915 I Street Sacramento, CA 95814
www.cityofsacramento.org
File ID: 2024-01620 9/10/2024 Consent Item 16.
Designation of the City of Sacramento as a Hybrid Entity under HIPAA File ID: 2024-01620
Location: Citywide
Recommendation: Adopt a Resolution: 1) reauthorizing acceptance of Designation of the City of Sacramento as a Hybrid Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and rescinding Resolution No. 2017-0482.
Contact: Gary Lindsey, Senior Deputy City Attorney, (916) 808-5346, [email protected], Office of the City Attorney Presenter: None
Attachments:
1-Description/Analysis
2-Resolution
Description/Analysis
Issue Detail: The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of health care coverage, standardize health care transactions, and implement requirements surrounding health information privacy and security.
In general, HIPAA addresses Protected Health Information (PHI) that is maintained or transmitted by a covered entity. Covered entities are:
· Health plans,
· Health care clearinghouses, and
· Health care providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations.
File ID: 2024-01620 9/10/2024 Consent Item 16.
The City of Sacramento (“City”) is a covered entity under HIPAA because it conducts certain types of transactions related to health care-primarily, the prehospital emergency medical services provided to the public through the Sacramento Fire Department. Nevertheless, the majority of City functions do not involve a connection to those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity, which performs both covered and non-covered functions, may designate itself as a hybrid entity under HIPAA.
A legal entity, which designates itself as a hybrid entity, may choose not to apply the Privacy Rule to its non-health care components of the organization. The entity must designate, as part of its covered functions, any component (e.g., department) that would meet the definition of a covered entity, if it were a separate legal entity. The entity may additionally choose to designate other components that assist mandatorily designated components in the performance, oversight, or legal representation of their covered functions.
All covered health care components must comply with HIPAA and the covered entity retains oversight, compliance, and enforcement obligations. (See 45 CFR 164.103 and 45 CFR 164.105.) The entity may have non-health care components impacted by the Privacy Rule because the health care components are limited in how they can share PHI with non-health components.
To be a hybrid entity, the covered entity must identify its components, which perform covered functions, and designate those components as health care components. A covered entity, which does not make this designation, is subject in its entirety to HIPAA.
The present reauthorization is a procedural update of the stated scope of the City’s hybrid designation in order to improve internal efficiency within the City for those city agencies for whom access HIPAA-regulated information is essential to performing covered functions on behalf of City.
The reauthorization includes adding of the City Manager’s Office and the Office of Public Safety Accountability to the City’s listed covered functions, a status already held by the Office of the City Auditor for the last seven years. The reauthorization also includes an update to reflect the Department of Youth, Parks, and Community Enrichment as the successor agency to the defunct Department of Parks and Recreation.
Policy Considerations: Designating the City as a hybrid HIPAA entity limits the City’s exposure to federal enforcement of HIPAA, because the necessity of HIPAA compliance would be restricted to only those health care components designated by the City. The remainder of the City would be exempt from compliance. A covered entity that does not make this designation is subject in its entirety to HIPAA.
Economic Impacts: None.
File ID: 2024-01620 9/10/2024 Consent Item 16.
Environmental Considerations:
California Environmental Quality Act (CEQA): The recommendations contained in this report do not constitute a “project” as defined by Section 21065 of the California Public Resources Code and therefore are not subject to the requirements of CEQA.
Sustainability: None.
Commission/Committee Action: None.
Rationale for Recommendation: Designating the City as a hybrid HIPAA entity limits the City’s exposure to federal enforcement of HIPAA, because the necessity of HIPAA compliance would be restricted to only those health care components designated by the City. The remainder of the City would be exempt from compliance. The City is eligible for this designation as it contains components engaged in both covered and non-covered functions. If the City does not make this designation, the entire governmental organization is subject to HIPAA.
Financial Considerations: None.
Local Business Enterprise (LBE): Not Applicable.
Background: Covered Entity - a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a covered transaction. (45 CFR 160.103.)
Covered Function - those functions of a covered entity of which the performance makes the entity a health plan, health care provider, or healthcare clearinghouse. (45 CFR 164.103.)
Hybrid Entity - a single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates its health care components, i.e. any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. (45 CFR 164.103, 45 CFR 164.105(a)(2)(iii)(D).) Health Care Component - a component, or combination of components, of a hybrid entity. (45 CFR 164.103.)
Business Associate - a person or entity that creates, receives, maintains, or transmits protected health information to perform certain functions or activities on behalf of a covered entity, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity, and the provision of the service involves the disclosure of
File ID: 2024-01620 9/10/2024 Consent Item 16.
protected health information. (45 CFR 160.103.)
RESOLUTION NO.
Adopted by the Sacramento City Council
[Date]
DESIGNATING THE CITY OF SACRAMENTO AS A HYBRID ENTITY UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
BACKGROUND
A. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of health care coverage, standardize health care transactions, and implement requirements surrounding health- information privacy and security.
B. In general, HIPAA addresses protected health information (PHI) that is maintained or transmitted by a covered entity. Covered entities are:
1. Health plans,
2. Health care clearinghouses, and
3. Health-care providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations.
C. The City of Sacramento (“City”) is a covered entity under HIPAA because it conducts certain types of transactions related to health care. However, the majority of City functions do not involve those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity that performs both covered and non-covered functions may designate itself as a hybrid entity under HIPAA.
D. A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to the non-health-care components of the organization. The entity must designate, as part of its covered functions, any component that would meet the definition of a covered entity if it were a separate legal entity. All covered health-care components must comply with HIPAA and the covered entity retains oversight, compliance, and enforcement obligations. See 45 CFR 164.103 and 45 CFR 164.105. The entity may have non-health- care components impacted by the Privacy Rule because the health-care components are limited in how they can share PHI with non-health-care components.
E. To be a hybrid entity, the covered entity must identify its components that perform covered functions and designate those components as health care components. A covered entity that does not make this designation is subject in its entirety to HIPAA.
F. The City first designated itself as a hybrid entity for HIPAA purposes in 2017 through City Council Resolution No. 2017-0482.
G. The Sacramento Fire Department (SFD) performs HIPAA-covered functions through its prehospital emergency medical services to the public. SFD’s covered functions include creation, receipt, and disclosure of protected health information (PHI) within the meaning of HIPAA, the disclosure of which is subject to HIPAA’s Privacy Rule and exceptions thereto (see 45 CFR 164.501, 164.508, and 164.512(i)).
H. In 2017 the City has previously designated its covered health care components that perform covered functions, including “business associate” type services to components that perform covered functions.
I. The City now seeks to update its list of designated covered health care components.
BASED ON THE FACTS SET FORTH IN THE BACKGROUND, THE CITY COUNCIL RESOLVES AS FOLLOWS:
Section 1: The City redesignates itself as a hybrid entity under HIPAA. This determination is made after an analysis of the varied departments and functions within the City. As a hybrid entity, the City conducts activities that are both covered and non-covered.
Section 2: As a hybrid entity, the applicable HIPAA compliance obligations only apply to the City’s designated covered health care components. The designated covered health care components include:
a. Any City component that would meet the definition of a covered entity if it were a separate legal entity;
b. City components, only to the extent that they perform covered functions; and
c. City components that provide “business-associate” type services to components that perform covered functions.
Section 3: The designated covered health care components are listed in Exhibit A.
Section 4: The Director of the Human Resources Department, or their designee, shall serve as the Privacy Officer for City for purposes of HIPAA compliance.
Section 5: The Privacy Officer shall retain, review, and amend Exhibit A as directed by the City Council, pursuant to this Resolution.
Section 6: Resolution No. 2017-0482 is hereby rescinded.
EXHIBIT A
I. Designated Covered Health Care Components. The following functions have been identified as covered components and must comply with HIPAA privacy rules and standards:
City Attorney’s Office, to the extent it provides business-associate services to parts of the City performing covered functions.
City Auditor’s Office, to the extent it performs covered functions and/or provides business- associate services to parts of the City performing covered functions.
City Clerk’s Office, to the extent it provides business-associate services to parts of the City performing covered functions.
City Manager’s Office, to the extent it performs covered functions.
Finance Department, to the extent it performs covered functions and/or provides business- associate services to parts of the City performing covered functions.
Fire Department, to the extent it performs covered functions and/or provides business- associate services to parts of the City performing covered functions.
Human Resources Department, to the extent it performs covered functions.
Information Technology Department, to the extent it provides business-associate services to parts of the City performing covered functions.
Office of Public Safety Accountability, to the extent it performs covered functions.
Youth, Parks, and Community Enrichment Department (formerly the Parks and Recreation Department), to the extent it performs covered functions and/or provides business- associate services to parts of the City performing covered functions.
II. Non-covered Components include:
City Council
City Treasurer’s Office
Councilmembers’ Offices
Community Development Department
Convention & Cultural Services Department
Department of Community Response
Department of Utilities
Mayor’s Office
Police Department
Public Works Department