10.
ORGANIZATIONAL REQUIREMENTS:

164.504(a)		    
10.1.
Relevant Definitions:
10.1.1.
Common control exists if entity has power to directly or indirectly direct or influence the actions or policies of another entity.
10.1.2.
Common ownership exists if entity(ies) possess ownership or equity interest of 5% or more of another entity.
10.1.3.
Health care component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with ¶ 10.3.3.3 and document this designation in accordance with ¶ 11.3.10.
10.1.4.
Hybrid entity means a single legal entity that is a covered entity whose business activities include both covered and non-covered functions and that designates health care components in accordance with ¶ 10.1.3.

164.501		    
 
10.1.5.
Organized health care arrangement means :
10.1.5.1.
A clinically integrated care setting in which individuals typically receive health care from more than one provider;
10.1.5.2.
An organized system of care in which multiple participating CEs:
10.1.5.2.1.
Hold themselves out to the public as a joint arrangement; and
10.1.5.2.2.
Participate in at least one of the following joint activities: (i) utilization review; (ii) quality assessment and improvement; or (iii) payment activities where there is shared financial risk;
10.1.5.3.
A group health plan and a health insurance issuer or HMO with respect to the plan, but only relating to PHI of participants or beneficiaries of the plan;
10.1.5.4.
Multiple group health plans maintained by the same plan sponsor; or
10.1.5.5.
Multiple group health plans maintained by the same plan sponsor and health insurance issuers or HMOs with respect to such plans, but only relating to PHI of participants or beneficiaries of the plan.
 
10.1.6.
Plan administration functions means administrative functions performed by the plan sponsor of a group health plan on behalf of that plan, and excludes functions performed by the sponsor in connection with any other benefit or plan of the sponsor.
 
10.1.7.
Summary health information means information that may be individually identifiable health information and
10.1.7.1.
That summarizes claims history, claims expenses, or types of claims relating to benefits under a group health plan; and
10.1.7.2.
Which has been de-identified pursuant to 164.514(b)(2)(i) [¶ 3.10.2.2.], except that geographic information need only be aggregated to the level of a five digit zip code.

164.504(b)		    
10.2.
Health Care Component: If a CE is a hybrid entity, except as specified in ¶ 10, the regulations apply only to the health care component of the entity.

164.504(c)		    
10.3.
Hybrid Entities:.
10.3.1.
Applicability of other provisions of the regulations to hybrid entities:
10.3.1.1.
Reference to a CE refers to the health care component of the CE;
10.3.1.2.
Reference to "health plan," "covered health care provider," or "health care clearinghouse" refers to health care component of CE if the component performs the functions of a health plan, covered health care provider or health care clearinghouse; and
10.3.1.3.
Reference to "protected health information" refers to PHI that is created or received by or on behalf of the health care component of the CE.
     
.
10.3.2.
Safeguard requirements: Hybrid entity must ensure that its health care components comply with applicable requirements of the regulations, including:
10.3.2.1.
Health care component does not disclose PHI to another component of the CE, if such sharing would not be permitted if the two components were separate and distinct legal entities;
10.3.2.2.
Component acting as a "business associate" does not use/disclose PHI it creates or receives from or on behalf of the other component other than as permitted in its "business associate" type functions, and
10.3.2.3.
Workforce members who perform duties for both health care component(s) and other component(s) of CE must not use/disclose PHI created or received in the course of their work for the health care component in a way that is prohibited hereunder.
 
10.3.3.
Responsibilities of hybrid entity:
10.3.3.1.
Comply with compliance and enforcement requirements of Subpart C, Part 160 [¶ 12.];
10.3.3.2.
Comply with implementation of policies and procedures required under 164.530(i) [¶ 11.3.9.]and safeguard provisions of 164.504(c)(2) [¶ 10.3.2.]; and
10.3.3.3.
Designate components that are part of one or more health care components of the CE and document the designations as required under 164.530(j) [¶ 11.3.10.], provided that, if the CE designates a health care component or provided that, if the CE designates a health care component or components, it must include any component that would meet the definition of CE if it were a separate legal entity. Health care component(s) also may include a component only to the extent that it performs: covered functions or activities that would make such component a BA of a component that performs covered functions if the two components were separate legal entities.
     
     

Table of Contents | Index | HIPAA Statewide Project