HomeMy WebLinkAboutOrder 021 - Hybrid Entity for HIPAA PurposesDeschutes County Board of Commissioners
1300 NW Wall St., Suite 200, Bend, OR 97701-1960
(541) 388-6570 -Fax (541) 385-3202 -www.deschutes.org
AGENDA REQUEST & STAFF REPORT
For Board Business Meeting of , 2015 I.J /1-J J5
DATE: 4/3/15
FROM: John Lahert~ Legal Department (541) 330-4645
I
J
TITLE OF AGENDA ITEM:
Board's consideration of Order 2015-021, Declaring Deschutes County a Hybrid Entity for HIPAA
Purposes, Identifying Health Care Components, Appointing Security Official and Privacy Official, and
Directing the Adoption and Implementation of Applicable Policies.
PUBLIC HEARING ON THIS DATE? No
BACKGROUND AND POLICY IMPLICATIONS:
Currently, the entirety of Deschutes County government is a HIP AA "Covered Entity." This means that
all County employees, whether they regularly access or use protected health information or not, must be
HIPAA-trained and must comply with HIPAA privacy and security rules regarding the maintainenace, \ use and disclosure of protected health information.
In order to reduce the number of County employees that are subject to HIP AA privacy and security
rules, County's Legal Department recommends that the County adopt "Hybrid Entity" status under
HIPAA. If the County becomes a Hybrid Entity, only those County departments/divisions that
regularly maintain, disclose or use protected health information (the "Health Care Components") would
be subject to HIPAA privacy and security rules. Those departments/divisions of County government
that do not regularly maintain, use or disclose protected health information (the "Non-Health Care
Components ") would not be subject to those rules. An organizational chart and list showing the
proposed Healthcare and Non-Healthcare componenets is attached hereto, as Exhibit "A".
It is anticipated that adopting Hybrid Entity status would make it easier for the County to (a) comply
with HIP AA tmining requirements, (b) satisfy HIPAA rules relating to the privacy and security of
protected health information, and (c) reduce the possibility ofHIPAA breaches by County employees
who do not regularly use protected health information and are, therefore, not familiar with HIP AA rules
governing that information.
FISCAL IMPLICATIONS:
It is anticipated that adoption of Hybrid Entity status will reduce the County's HIPAA training costs.
RECOMMENDATION & ACTION REQUESTED:
MOTION: Approve signature of Order 2015--() 2-1.
ATTENDANCE: John Laherty
DISTRIBUTION OF DOCUMENTS:
BOCC; Administration, Legal
For Recording Stamp Only
BEFORE THE BOARD OF COUNTY COMMISSIONERS OF DESCHUTES COUNTY, OREGON
Order for County's Adoption of Hybrid Entity *
Status for HIP AA Purposes * ORDER NO. 2015-021
*
WHEREAS, the 1996 Health Insurance Portability and Accountability Act (HIPAA) and its
implementing regulations impose a variety of requirements on public entities to protect the privacy of
individually identifiable health information; and
WHEREAS, while some departments and divisions of Deschutes County government (the "Health Care
Components") regularly receive, create, maintain, use or share individually identifiable health information in the
performance of their duties, other departments and divisions of Deschutes County government (the "Non-Health
Care Components") do not; and
WHEREAS, the County has developed an organizational chart and list identifYing the Health Care
Components and Non-Health Care Components of Deschutes County government (Attachment A hereto); and
WHEREAS, it is in the best interest of Deschutes County that only the Health Care Components of
Deschutes County government should be subject to HIP AA and its implementing regulations; now, therefore,
THE BOARD OF COUNTY COMMISSIONERS OF DESCHUTES COUNTY, OREGON, HEREBY
ORDERS as follows:
Section 1. Deschutes County is declared a "Hybrid Entity" for all purposes related to HIPAA
and its implementing regulations;
Section 2. The various departments and divisions of Deschutes County government are
identified as Health Care Components or Non -Health Care Components in accordance with the
organizational chart and list attached hereto as "Attachment A," which chart and list may be revised
from time to time upon order of this Board;
Section 3. Erik Kropp, Deputy County Administrator, shall continue to serve as the County's
"Security Official" and "Privacy Official" for HIPAA purposes; and
PAGE 1 OF 2-ORDER No. 2015-021 (APRIL 2015)
Section 4: Mr. Kropp, as the County's Security Official and Privacy Official, shall develop and
implement HIP AA-compliant policies for the Health Care Components of County government, and
take such other steps are reasonably necessary to effectuate and implement the terms of this Order.
Dated this ___of ____,' 2015 BOARD OF COUNTY COMMISSIONERS
OF DESCHUTES COUNTY, OREGON
ANTHONY DEBONE, Chair
ALAN UNGER, Vice Chair
ATTEST:
Recording Secretary TAMMY BANEY, Commissioner
PAGE 2 OF 2-0RDER No. 2015·021 (APRlL 2015)
DESCHUTES COUNTY --List of "Health Care Components" for HIPAA purposes
The following list identifies those specific departments and divisions of Deschutes County
government identified as "Health Care Components" for HIP AA purposes. This list is intended
to be used in conjunction with the chart entitled "Deschutes County Organizational Chart
HIPAA Hybrid Entity."
Board of County Commissioners
Community Justice -all divisions
County Administrator
County Sheriff --Corrections division only
Deputy County Administrator
Health Services -all divisions
Information Technology -Technology and Web Applications divisions only
Internal Auditing
Legal Counsel and County Legal Dept.
Personnel Health Benefits division only
Risk Management -all divisions
Veterans Services
EXHIBIT...:...I.rt_PAGE~
Deschutes County Organizational Chart -HIP AA Hybrid Entity
Citizens of
Deschutes County
InternalS ervice Departments
EXHIBIT -.:...8..a...-_PAGE ~