POL-U1000.14 Designating WWU As A HIPAA Hybrid Entity (Interim)
Jump to section
Dates and Approval
Effective Date:
January 27, 2026
Approval Date:
January 26, 2026
Approved by:
President Sabah Randhawa
Who does this policy apply to?
This policy applies to all WWU academic and administrative units; all employees, contractors, volunteers, and students who may access PHI and covered components as defined in this policy.
Overview
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law intended to strengthen the privacy and security of individuals' health information. HIPAA applies to "covered entities," as defined under the privacy, security, breach notification, and enforcement rules at 45 C.F.R. Part 160 and Part 164 ("HIPAA Rules"). HIPAA covered entities include health plans, health plan clearinghouses, and Health Care Providers that transmit health information electronically in certain types of transactions. A single legal entity that conducts both HIPAA-covered and non-covered functions may designate itself as a Hybrid Entity for HIPAA compliance purposes.
Definitions
Business Associate
As defined in 45 CFR § 160.103.
Covered Entity
A health plan, a health care clearinghouse, or a Health Care Provider who transmits any health information in electronic form in connection with a transaction covered under HIPAA (45 CFR § 160.103).
Covered Functions
Those functions of a Covered Entity, the performance of which makes the entity a health plan, Health Care Provider, or health care clearinghouse (45 CFR § 164.103).
Health Care Component
A component or combination of components of a Hybrid Entity designated by the Hybrid Entity in accordance with 45 CFR § 164.105(a)(2)(iii)(D) (45 CFR § 164.103).
Health Care Provider
Includes a provider of medical or health services, as defined by law, and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business (45 CFR § 160.103).
Health Care Provider
Includes a provider of medical or health services, as defined by law, and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business (45 CFR § 160.103).
Hybrid Entity
A single legal entity (1) that is a Covered Entity; (2) whose business activities include both covered and non-covered functions; and (3) that designates Health Care Components in accordance with 45 CFR § 164.105(a)(2)(iii)(D) (45 CFR § 164.103)
Individually Identifiable Health Information
As defined in 45 CFR § 160.103.
Protected Health Information (“PHI”)
Individually Identifiable Health Information transmitted or maintained electronically or in any other form or medium (except as otherwise excluded by regulation) See excluded records in Section 4 (45 CFR § 160.103).
Policy Statements
1. University Invokes HIPAA Hybrid Entity Status
Some components within the University perform activities or functions that bring them within the definition of a Covered Entity for HIPAA purposes. University therefore chooses to invoke Hybrid Entity status and must designate and document as its "Health Care Component(s)" each component within the University that would meet the definition of a Covered Entity or a Business Associate if it were a single legal entity. This HIPAA Hybrid Entity Policy specifically addresses the requirements of 45 C.F.R. Sections 164.103 and 164.105, which involve organizational requirements for hybrid entities under HIPAA, among other issues.
Although the University is responsible for HIPAA oversight, compliance, and enforcement requirements, as applicable, the HIPAA Rules apply only to the University’s designated Health Care Components. The University also is responsible for compliance with additional federal and state requirements and remains committed to ensuring that personal health information accessed by any University unit or component is handled in accordance with applicable state and federal regulations .
2. Specific University Components are Designated as Health Care Components
The University has designated certain of its componens as its health and components based on one or more of the following factors:
The component would meet the definition of a Covered Entity if it were a separate legal entity,
The component would meet the definition of a Business Associate if it were a separate legal entity, and/or
A component is included if it performs Covered Functions.
The follwwing components of the University are designated as its Health Care Components and must comply with the requirements of HIPAA, as applicable:
Student Health Center,
Counseling and Wellmess Center
Those elements of Western's Information Technology Department not housed within a Designated Health Care Compnents, but which have access to the Electonic Meical Records system, and
Risk Mamagement.
3. Health Care Components Must Comply with Required Safeguards
The University shall ensure that its Health Care Components comply with the HIPAA Rules regarding health records, as applicable, subject to the exclusions in section 4 below. In particular, the University shall ensure that:
- Its Health Care Components do not disclose Protected Health Information to another component of the University in a manner that would be prohibited under the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E) if the Health Care Component and other component were separate legal entities;
- Its Health Care Components protect electronic Protected Health Information regarding another component of the University to the same extent that they would be required to protect this information under the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) if the Health Care Components and other component were separate legal entities; and
- If a person performs duties as a workforce member for both a Health Care Component and a non-Health Care Component of the University, the person does not use or disclose Protected Health Information created or received in the course of (or incident to) the person's work for the Health Care Component in a way that is prohibited under the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E).
The University shall comply with HIPAA's requirements concerning compliance and enforcement (45 C.F.R. Part 160, Subpart C).
The University shall comply with requirements under the HIPAA Privacy Rule and Security Rule regarding implementation of compliance policies and procedures (45 C.F.R. §§ 164.316(a) and 164.530(i)), including the safeguards addressed above. Although excluded from the HIPAA Privacy Rule, the University has elected to model its security policies regarding excluded health records, when handled by designated Health Care Components, on the HIPAA Security rule.
The University shall ensure compliance with requirements under the HIPAA Privacy Rule and Security Rule regarding Business Associate arrangements and other organizational requirements (45 C.F.R. §§ 164.314 and 164.504).
4. Certain Health Records are not Protected Health Information Under HIPAA
- Employee Health Records:
Through its Human Resources and Environmental Health and Safety offices, the University maintains employee health records in its capacity as an employer. Employee health records are expressly excluded from the definition of Protected Health Information under the HIPAA Rules, and the University’s human resources office is not one of the University’s designated Health Care Components. - Educational Records:
The University maintains student health records which are defined as education records under the Family Educational Rights and Act (FERPA). Education records covered by FERPA are expressly excluded from the definition of Protected Health Information under the HIPAA Rules. However, student health records are subject to the HIPAA Administrative Simplification Requirements for the insurance billing process. - Treatment records of a student over the age of 18:
Such records, as described under 20 U.S.C. 1232g(a)(4)(B)(iv) are expressly excluded from the definition of Protected Health Information under the HIPAA Rules. However, such records are subject to the HIPAA Administrative Simplification Requirements for the insurance billing process.
5. The University Must Maintain Specific Records
The University shall retain documentation evidencing its Health Care Component designation for at least six years following the date of a decision to remove a component's designation as a Health Care Component. Otherwise, the University shall retain documentation evidencing Health Care Component designations indefinitely.
6. The University Appoints HIPAA Privacy and Security Officers
The University Provost is responsible for identifying the University’s HIPAA Privacy Officer and HIPAA Security Officer for its Health Care Components.
- The HIPAA Privacy Officer oversees the development, implementation and management of the University’s privacy policies and procedures and oversees HIPAA training and compliance investigations.
- The HIPAA Security Officer oversees the development, implementation and management of the University’s security and breach notification policies and procedures, including management of technical safeguards and risk assessments.
- The HIPAA Privacy Officer and HIPAA Security Officer oversee and retain ultimate responsibility for their respective functions but may delegate certain responsibilities to healthcare component directors who ensure compliance with HIPAA, federal and state privacy laws within their respective University units. These delegated responsibilities may include developing and enforcing standards and procedures to safeguard PHI.
The University has appointed the Director of Risk Management and Compliance as its HIPAA Privacy Officer and the Senior Director of Enterprise Infrastructure Services as its HIPAA Security Officer for its Health Care Components.
For any questions regarding the University’s compliance with the HIPAA Rules and their implementing regulations concerning the Health Care Components, please contact the HIPAA Privacy or Security Officer.
7. Violations are Subject to Disciplinary Action
University departments who are not within designated Health Care Components but who, contrary to this policy, engage in Covered Functions put the University at risk for financial penalties and reputational harm and responsible employees will be subject to disciplinary action including termination.
8. The University’s Hybrid Status will be Reviewed Regularly
The HIPAA Privacy Officer will rrview this policy regularly, no more than every two years, and following any significant emergency, audit, or regulatory or operational change.