Ohio State University HIPAA Hybrid Entity Designation

View full policy

The Ohio State University Hybrid Entity Statement

The University conducts both Covered and non-Covered Functions and elects to be a Hybrid Entity under HIPAA as provided by 45 C.F.R. § 164.103 and 45 C.F.R. § 164.105.

Hybrid Entity Responsibilities

As a Hybrid Entity, the University is responsible for designating the Components that are Healthcare Components within the University. Healthcare Components must include any unit of the University that would itself meet the definition of a Covered Entity or a Business Associate if that unit was a legal entity separate from the University. Hybrid Entities may also include a unit as a Healthcare Component only to the extent that the unit performs Business Associate Functions for another Healthcare Component within the Hybrid Entity. Therefore, the University determines the following:

1. Designated Healthcare Components. The University's designated Healthcare Components, and those units providing Business Associate Functions for its designated Healthcare Components, are listed in Exhibit 1. This list may be updated from time to time by the University Integrity and Compliance Council.
2. University Responsibility. The University, through the University Integrity and Compliance Council, shall ensure that designated Healthcare Components comply with applicable HIPAA requirements. The University Integrity and Compliance Council, in consultation with Legal Counsel, shall review and amend Exhibit Bas needed, but no less frequently than bi-annually.     
3. Healthcare Component Responsibility. Each designated Healthcare Component shall adhere to applicable HIPAA requirements. Each unit providing Business Associate Functions for a Healthcare Component shall follow the requirements of the designated Healthcare Component for which it provides such Functions. Each designated Healthcare Component shall provide a report of its compliance with HIPAA requirements to the University Integrity and Compliance Council at least annually.

This document reaffirms the University as a HIPAA Hybrid Entity and designated the University's Healthcare Components as set forth in Exhibit 2.

Recommendation of Chief Executive Officer, The Ohio State University Wexner Medical Center and Executive Vice President, The Ohio State University

I recommend the designation of the University as a Hybrid Entity as set forth in this document.
Executed this 27th day of January 2026,
Dr. John J. Warner
Chief Executive Officer, The Ohio State University Wexner Medical Center and Executive Vice President, The Ohio State University

Recommendation of the Provost

I recommend the designation of the University as a Hybrid Entity as set forth in this document.
Executed this 27th day of January 2026,
Dr. Ravi V. Bellamonkda
Executive Vice President and Provost, The Ohio State University

Designation of the University as a Hybrid Entity

I hereby reaffirm the designation of the University as a Hybrid Entity. In accordance with HIPAA, this designation shall be retained for a period of six years from the date it was last in effect.
Executed this 27th day of January 2026,
Walter “Ted” Carter, Jr.
President, The Ohio State University

Exhibit 1

Definitions

Business Associate: a person or entity that creates, receives, maintains or transmits protected health information to perform certain functions or activities on behalf of a covered entity; or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity and the provision of the service involves the disclosure of protected health information. 45 C.F.R. § 160.103.

Business Associate Functions: functions or activities described in this definition of Business Associate.

Covered Entity: a health plan, a healthcare clearinghouse or a healthcare provider who transmits any health information in electronic form in connection with a covered transaction. 45 C.F.R. § 160.103.

Covered Function: functions performed by a Covered Entity which makes the Entity a health plan, healthcare provider, or healthcare clearinghouse. 45 C.F.R. § 164.103.

Healthcare Component: a component or combination of components of a Hybrid Entity designated by the Hybrid Entity in accordance with 45 C.F.R. § 164.105(a)(2)(iii)(C). 45 C.F.R. § 164.103.

Hybrid Entity: a single legal entity that conducts both Covered and non-Covered functions and that designates Healthcare Components in accordance with 45 C.F.R. § 164.105(a)(2)(iii )(D). 45 C.F.R. § 164.103.

Transaction: the transmission of information between two parties to carry out financial or administrative activities related to healthcare and includes the following transmissions:

1. Healthcare claims or equivalent encounter information.
2. Healthcare payment and remittance advice.
3. Coordination of benefits.
4. Healthcare claim status.
5. Enrollment and disenrollment in a health plan.
6. Eligibility for a health plan.
7. Health plan premium payments.
8. Referral certification and authorization
9. First report of injury.
10. Health claims attachments.
11. Healthcare electronic funds transfers (EFT) and remittance advice.
12. Other transactions that the Secretary may prescribe by regulation. 45 C.F.R. § 160.103.

Exhibit 2

The Ohio State University Designated Healthcare Components

1. The Health System includes

a. The Ohio State University Wexner Medical Center

• University Hospital
• University Hospital – Rhodes Hall
• University Hospital – Doan Hall
• East Hospital
• Richard M. Ross Heart Hospital
• Harding Hospital
• Dodd Rehabilitation Hospital
• Ambulatory Clinics and Services
• Ambulatory Surgery Centers
• Ohio State University Outpatient Pharmacies

b. Arthur G. James Cancer Hospital and the Richard J. Solove Research Institute - Comprehensive Cancer Center

2. College of Dentistry
3. College of Optometry
4. Nisonger Center
5. OSU Health Plan
6. OSU Physicians, Inc.
7. Wilce Student Health Center

The University acknowledges that the following Service Units create, receive, maintain, or transmit PHI as a Business Associate Function for a Healthcare Component. The following University units are therefore included in the Healthcare Component to the extent they provide Business Associate Functions to that Healthcare Component:

Service Units:

1. Civil Rights Compliance Office
2. College of Medicine (including Government Resource Center)
3. College of Nursing
4. Office of Administration and Planning
   a. Office of Technology and Digital Innovation
5. Office of Advancement
6. Office of Business and Finance
   a. Department of Internal Audit
   b. Office of the University Bursar
   c. University Risk Management
7. Office of Human Resources
8. Office of Legal Affairs
9. Office of University Compliance and Integrity

Updated: January 2026