Chapter 22H — DESIGNATION UNDER HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT…

Sec. 22H.1. Background.

Sec. 22H.2. Hybrid Entity Designation.

Sec. 22H.3. Definitions.

Sec. 22H.4. Designation of Covered Entities and Business Associates; Reports.

Sec. 22H.5. Undertaking for the General Welfare.

(a) The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. §§ 1320d et seq., requires entities that perform certain health care functions to comply with regulations related to the use, disclosure, and security of individually identifiable health information.

(b) HIPAA permits a single legal entity that is engaged in both covered health care functions and non-covered functions to designate itself a “Hybrid Entity.” To become a Hybrid Entity, the single legal entity must identify and designate as health care components those departments or divisions of the entity that perform 1) covered health care functions or 2) activities that involve the use or disclosure of protected health information on behalf of another department or division thereof that performs covered health care functions. Once the single legal entity makes a Hybrid Entity designation, HIPAA and its implementing regulations apply only to those components of the entity that are designated as health care components, and do not apply to the remainder of the entity.

(Added by Ord. 42-20, File No. 191279, App. 3/13/2020, Eff. 4/13/2020)

The City performs functions as a health care provider and health plan that make it subject to HIPAA. The City also performs many functions that are unrelated to health care and are not subject to compliance with HIPAA. The City is, therefore, a single legal entity that engages both in health care functions covered by HIPAA, and also in non-HIPAA-covered functions. Accordingly, the City is hereby designated as a Hybrid Entity.

(Added by Ord. 42-20, File No. 191279, App. 3/13/2020, Eff. 4/13/2020)

For purposes of this Chapter 22H, the following terms have the following meanings:

“Business Associate” has the meaning set forth in 45 C.F.R. § 160.103, as may be amended from time to time.

“City” means the City and County of San Francisco.

“City Administrator” means the City Administrator, or the City Administrator’s designee.

“Covered Entity” has the meaning set forth in 45 C.F.R. § 160.103, as may be amended from time to time.

“Covered Function” has the meaning set forth in 45 C.F.R. § 164.103, as may be amended from time to time.

“Health Care Component” has the meaning set forth in 45 C.F.R. § 164.103, as may be amended from time to time.

“Hybrid Entity” has the meaning set forth in 45 C.F.R. § 164.103, as may be amended from time to time.

“Protected Health Information” has the meaning set forth in 45 C.F.R. § 160.103, as may be amended from time to time.

(Added by Ord. 42-20, File No. 191279, App. 3/13/2020, Eff. 4/13/2020)

This Chapter 22H shall be administered by the City Administrator, who shall have the following responsibilities:

(a) Within one month of the effective date of this Chapter 22H, and not less than every three years thereafter, the City Administrator shall issue a report identifying every City department and/or division thereof that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity. This report shall be prepared in consultation with the City Attorney, based on a review of the functions performed by City departments and divisions thereof.

(b) If, prior to the deadline for issuance of the second or subsequent reports required by subsection (a), a new City department or division is established that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity, or the function(s) of existing City departments or divisions change in a way that would alter the existing designation of Health Care Components approved by the Board of Supervisors referenced in subsection (c), the City Administrator shall submit to the Board of Supervisors an interim report identifying every City department and/or division thereof that would meet the definition of a Covered Entity or Business Associate if it were a separate legal entity.

(c) Upon issuing a report referenced in subsection (a) or (b), the City Administrator shall submit the report to the Board of Supervisors, accompanied by a proposed resolution to accept the report and to designate as Health Care Components the City departments and/or divisions thereof that would meet the definition of a Covered Entity or Business Associate if they were separate legal entities. In making this designation, the Board is not bound by the City Administrator’s report.

(d) The City Administrator shall publish on the City Administrator’s website an up-to-date list of the City departments and/or divisions thereof that are designated as Health Care Components by resolution of the Board of Supervisors in accordance with subsection (c).

(e) The City Administrator shall retain documentation of each report issued pursuant to subsection (a) or (b) and submitted to the Board of Supervisors under subsection (c), for six years from the date of its submission.

(f) The City Administrator shall develop, maintain, and administer a citywide HIPAA compliance policy concerning the use and disclosure of Protected Health Information in compliance with HIPAA and its implementing regulations. Each City department that is designated as a Health Care Component, or that operates a division or program that is designated as a Health Care Component, shall be responsible for developing policies and procedures relevant to its specific HIPAA compliance responsibilities, subject to the approval of the City Administrator, if the City Administrator imposes an approval requirement on some or all affected departments.

(Added by Ord. 42-20, File No. 191279, App. 3/13/2020, Eff. 4/13/2020)

In enacting and implementing this Chapter 22H, the City is assuming an undertaking only to promote the general welfare. It is not assuming, nor is it imposing on its officers and employees, an obligation for breach of which it is liable in money damages to any person who claims that such breach proximately caused injury.

(Added by Ord. 42-20, File No. 191279, App. 3/13/2020, Eff. 4/13/2020)