The Ohio State University (University) designated itself a Hybrid Entity in accordance with federal law in 2003 and 2010. This document serves to reaffirm the University's Hybrid Entity designation and to set forth its ongoing oversight. The purpose of a Hybrid Entity designation is to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended in 2009 by the Health Information Technology for Economic and Clinical Health Act (HITECH Act). These federal laws are designed to improve the portability and continuity of health care coverage, standardize health care transactions, and improve health information privacy and security. HIPAA addresses Protected Health Information (PHI) that is created, received, maintained or transmitted by a Covered Entity. Covered Entities include the following types of organizations if they conduct certain types of Transactions in electronic form: health plans, health care clearinghouses, and health care providers.
A Covered Entity that is a single legal entity and conducts both Covered and non-Covered Functions may elect to be a Hybrid Entity. To be a Hybrid Entity, a Covered Entity must identify its components that perform Covered Functions and designate these components as Health Care Components. HIPAA compliance obligations apply only to designated Health Care Components; a Covered Entity that does not make the Hybrid Entity designation is subject to HIPAA in its entirety.
The Ohio State University Hybrid Entity Statement
The University conducts both Covered and non-Covered Functions and elects to be a Hybrid Entity under HIPAA as provided by 45 C.F.R. § 164.103 and 45 C.F.R. § 164.105.
Hybrid Entity Responsibilities
As a Hybrid Entity, the University is responsible for designating the Components that are Health Care Components within the University. Health Care Components must include any unit of the University that would itself meet the definition of a Covered Entity or a Business Associate if that unit was a legal entity separate from the University. Hybrid Entities may also include a unit as a Health Care Component only to the extent that the unit performs Business Associate Functions for another Health Care Component within the Hybrid Entity. Therefore, the University determines the following:
- Designated Health Care Components. The University's designated Health Care Components, and those units providing Business Associate Functions for its designated Health Care Components, are listed in Exhibit 1. This list may be updated from time to time by the University Integrity and Compliance Council.
- University Responsibility. The University, through the University Integrity and Compliance Council, shall ensure that designated Health Care Components comply with applicable HIPAA requirements. The University Integrity and Compliance Council, in consultation with Legal Counsel, shall review and amend Exhibit Bas needed, but no less frequently than bi-annually, and amend as needed.
- Health Care Component Responsibility. Each designated Health Care Component shall adhere to applicable HIPAA requirements. Each unit providing Business Associate Functions for a Health Care Component shall follow the requirements of the designated Health Care Component for which it provides such Functions. Each designated Health Care Component shall provide a report of its compliance with HIPAA requirements to the University Integrity and Compliance Council at least annually.
This document reaffirms the University as a HIPAA Hybrid Entity and designated the University's Health Care Components as set forth in Exhibit 2.
Recommendation of Chancellor, The Ohio State University Wexner Medical Center
I recommend the designation of the University as a Hybrid Entity as set forth in this document.
Executed this 23rd day of January 2024,
Dr. John J. Warner
Chief Executive Officer, The Ohio State University Wexner Medical Center and Executive Vice President, The Ohio State University
Recommendation of the Provost
I recommend the designation of the University as a Hybrid Entity as set forth in this document.
Executed this 23rd day of January 2024,
Dr. Karla S. Zadnik
Interim Executive Vice President and Provost, The Ohio State University
Designation of the University as a Hybrid Entity
I hereby reaffirm the designation of the University as a Hybrid Entity. In accordance with HIPAA, this designation shall be retained for a period of six years from the date it was last in effect.
Executed this 23rd day of January 2024,
Walter “Ted” Carter, Jr.
President, The Ohio State University
Exhibit 1
Definitions
Business Associate: a person or entity that creates, receives, maintains or transmits protected health information to perform certain functions or activities on behalf of a covered entity; or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity and the provision of the service involves the disclosure of protected health information. 45 C.F.R. § 160.103.
Business Associate Functions: functions or activities described in this definition of Business Associate.
Covered Entity: a health plan, a health care clearinghouse or a health care provider who transmits any health information in electronic form in connection with a covered transaction. 45 C.F.R. § 160.103.
Covered Function: functions performed by a Covered Entity which makes the Entity a health plan, health care provider, or health care clearinghouse. 45 C.F.R. § 164.103.
Health Care Component: a component or combination of components of a Hybrid Entity designated by the Hybrid Entity in accordance with 45 C.F.R. § 164.105(a)(2)(iii)(C). 45 C.F.R. § 164.103.
Hybrid Entity: a single legal entity that conducts both Covered and non-Covered functions and that designates Health Care Components in accordance with 45 C.F.R. § 164.105(a)(2)(iii )(D). 45 C.F.R. § 164.103.
Transaction: the transmission of information between two parties to carry out financial or administrative activities related to health care and includes the following transmissions:
- Health care claims or equivalent encounter information.
- Health care payment and remittance advice.
- Coordination of benefits.
- Health care claim status.
- Enrollment and disenrollment in a health plan.
- Eligibility for a health plan.
- Health plan premium payments.
- Referral certification and authorization
- First report of injury.
- Health claims attachments.
- Health care electronic funds transfers (EFT) and remittance advice.
- Other transactions that the Secretary may prescribe by regulation. 45 C.F.R. § 160.103.
Exhibit 2
The Ohio State University Designated Health Care Components
- The Health System includes
- The Ohio State University Wexner Medical Center
- University Hospital
- East Hospital
- Brain and Spine Hospital
- Richard M. Ross Heart Hospital
- Harding Hospital
- Dodd Rehabilitation Hospital
- Ambulatory Clinics and Services
- Ambulatory Surgery Centers
- Ohio State University Outpatient Pharmacies
- Arthur G. James Cancer Hospital and the Richard J. Solove Research Institute - Comprehensive Cancer Center
- The Ohio State University Wexner Medical Center
- College of Dentistry
- College of Optometry
- Nisonger Center
- OSU Health Plan
- OSU Physicians, Inc.
- Wilce Student Health Center
The University acknowledges that the following units create, receive, maintain, or transmit PHI as a Business Associate Function for a Health Care Component. The following University units are therefore included in the Health Care Component to the extent they provide Business Associate Functions to that Health Care Component:
Service Units:
- College of Medicine (including Government Resource Center)
- College of Nursing
- College of Pharmacy
- Office of Administration and Planning
- Office of Business and Finance
- University Risk Management
- Department of Internal Audit
- Office of Technology and Digital Innovation
- Office of Human Resources
- Office of Institutional Equity
- Office of Legal Affairs
- Office of University Compliance and Integrity
- Technology Commercialization Office
- University Office of Advancement
Updated: January 2024