City Council Report 915 I Street, 1 st Floor Sacramento, CA

Transcription

1 City Council Report 915 I Street, 1 st Floor Sacramento, CA File ID: December 19, 2017 Consent Item 10 Title: Designation of the City of Sacramento as a Hybrid Entity under HIPAA Location: Citywide Recommendation: Pass a Resolution authorizing acceptance of Designation of the City of Sacramento as a Hybrid Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Contact: Samantha Wallace, Human Resources Manager, (916) ; Shelley Banks- Robinson, Acting Director of Human Resources, (916) , Human Resources Department Presenter: None Attachments: 1-Description/Analysis 2-Resolution Matthew Ruyak, Interim City Attorney Mindy Cuppy, City Clerk John Colville, City Treasurer Howard Chan, City Manager Page 1 of 7

2 File ID: Consent Item 10 Description/Analysis Issue Detail: The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of health care coverage, standardize health care transactions, and implement requirements surrounding health information privacy and security. In general, HIPAA addresses Protected Health Information (PHI) that is maintained or transmitted by a covered entity. Covered entities are: Health plans, Health care clearinghouses, and Health care providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations. The City of Sacramento ( City ) is a covered entity under HIPAA because it conducts certain types of transactions related to health care. However, the majority of City functions do not involve those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity that performs both covered and non-covered functions may designate itself as a hybrid entity under HIPAA. A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to its non-health care components of the organization. The entity must designate, as part of its covered functions, any component that would meet the definition of a covered entity if it were a separate legal entity. All covered health care components must comply with HIPAA and the covered entity retains oversight, compliance, and enforcement obligations. See 45 CFR and 45 CFR The entity may have non-health care components impacted by the Privacy Rule because the health care components are limited in how they can share PHI with non-health components. To be a hybrid entity, the covered entity must identify its components, which perform covered functions and designate those components as health care components. A covered entity, which does not make this designation, is subject in its entirety to HIPAA. Policy Considerations: Designating the City as a hybrid HIPAA entity limits the City s exposure to federal enforcement of HIPAA, because the necessity of HIPAA compliance would City of Sacramento December 19, 2017 powered by Legistar Page 2 of 7

3 File ID: Consent Item 10 be restricted to only those health care components designated by the City. The remainder of the City would be exempt from compliance. A covered entity that does not make this designation is subject in its entirety to HIPAA. Economic Impacts: None Environmental Considerations: California Environmental Quality Act (CEQA): The recommendations contained in this report do not constitute a project as defined by Section of the California Public Resources Code and therefore are not subject to the requirements of CEQA. Sustainability: None Commission/Committee Action: None Rationale for Recommendation: Designating the City as a hybrid HIPAA entity limits the City s exposure to federal enforcement of HIPAA, because the necessity of HIPAA compliance would be restricted to only those health care components designated by the City. The remainder of the City would be exempt from compliance. The City is eligible for this designation as it contains components engaged in both covered and non-covered functions. If the City does not make this designation, the entire governmental organization is subject to HIPAA. Financial Considerations: None Local Business Enterprise (LBE): Not Applicable Background: Covered Entity a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a covered transaction. 45 CFR Covered Function those functions of a covered entity of which the performance makes the entity a health plan, health care provider, or healthcare clearinghouse. 45 CFR Hybrid Entity a single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates its health care components, i.e. any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. 45 CFR and 45 CFR (a)(2)(iii)(D) City of Sacramento December 19, 2017 powered by Legistar Page 3 of 7

4 File ID: Consent Item 10 Health Care Component a component, or combination of components, of a hybrid entity. 45 CFR Business Associate a person or entity that creates, receives, maintains, or transmits protected health information to perform certain functions or activities on behalf of a covered entity, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity, and the provision of the service involves the disclosure of protected health information. 45 CFR City of Sacramento December 19, 2017 powered by Legistar Page 4 of 7

5 RESOLUTION NO. Adopted by the Sacramento City Council [Date] AUTHORIZING ACCEPTANCE OF DESIGNATION OF THE CITY OF SACRAMENTO AS A HYBRID ENTITY UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) BACKGROUND A. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of health care coverage, standardize health care transactions, and implement requirements surrounding health information privacy and security. B. In general, HIPAA addresses Protected Health Information (PHI) that is maintained or transmitted by a covered entity. Covered entities are: 1. Health plans, 2. Health care clearinghouses, and 3. Health care providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations. C. The City of Sacramento ( City ) is a covered entity under HIPAA because it conducts certain types of transactions related to health care. However, the majority of City functions do not involve those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity that performs both covered and non-covered functions may designate itself as a hybrid entity under HIPAA. D. A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to its non-health care components of the organization. The entity must designate, as part of its covered functions, any component that would meet the definition of a covered entity if it were a separate legal entity. All covered health care components must comply with HIPAA and the covered entity retains oversight, compliance, and enforcement obligations. See 45 CFR and 45 CFR The entity may have non-health care components impacted by the Privacy Rule because the health care components are limited in how they can share PHI with non-health components. E. To be a hybrid entity, the covered entity must identify its components, which perform covered functions and designate those components as health care components. A covered entity, which does not make this designation, is subject in its entirety to HIPAA. Page 5 of 7

6 BASED ON THE FACTS SET FORTH IN THE BACKGROUND, THE CITY COUNCIL RESOLVES AS FOLLOWS: Section 1: Section 2: The City designates itself as a hybrid entity under HIPAA. This determination is made after an analysis of the varied departments and functions within the City. As a hybrid entity, the City conducts activities that are both covered and non-covered functions. As a hybrid entity, the applicable HIPAA compliance obligations only apply to the City s designated health care components. The designated health care components include: a. Any City component that meets the definition of covered entity if it were a separate legal entity; b. City components, only to the extent that they perform covered functions; and c. City components that provide business associate type services to components that perform covered functions. Section 3: The designated health care components are listed in Exhibit A. Section 4: Section 5: The Director of the Human Resources Department, or his or her designee, shall serve as the Privacy Officer for City for purposes of HIPAA compliance. The Privacy Officer shall retain, review, and amend Exhibit A as needed, but no less frequently than annually. Page 6 of 7

7 EXHIBIT A I. Designated Covered Health Care Components. The following functions have been identified as covered components and must comply with HIPAA privacy rules and standards: Fire Department, to the extent it performs covered functions and/or provides business associate type services to parts of the City performing covered functions Human Resources Department, to the extent it performs covered functions Finance Department, to the extent it performs covered functions and/or provides business associate type services to parts of the City performing covered functions City Attorney s Office, to the extent it provides business associate type services to parts of the City performing covered functions City Auditor s Office, to the extent it provides business associate type services to parts of the City performing covered functions City Clerk s Office, to the extent it provides business associate type services to parts of the City performing covered functions Information Technology Department, to the extent it provides business associate type services to parts of the City performing covered functions Parks & Recreation, to the extent it performs covered functions and/or provides business associate type services to parts of the City performing covered functions II. Non-covered Components include: City Council Mayor s Office Councilmembers Offices Independent Budget Analyst s Office City Manager s Office City Treasurer s Office Community Development Department Convention & Cultural Services Department Economic Development Department Police Department Public Works Department Utilities Department Page 7 of 7