The Public Safety and Neighborhood Services Committee of the San Francisco Board of Supervisors voted unanimously Thursday to forward to the full board a resolution accepting the city administrator’s report that adds three offices to the city’s list of healthcare components under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The designation matters because Chapter 22H of the Administrative Code requires the city to identify which departments perform operations subject to HIPAA protections and to re-review that status every three years. Chair Supervisor Matt Dorsey moved to forward the item with a positive recommendation; Supervisors Danny Sauter and Bilal Mahmood joined him in a 3–0 vote.

The report, presented by the city administrator’s project manager, identified three offices newly meeting the HIPAA business-associate definition: the Controller’s Office, the Department of Homelessness and Supportive Housing and DATA SF. The presentation said the city previously designated six agencies in 2021 — the Department of Public Health, Fire Department, Health Service System, City Attorney’s Office, Treasurer & Tax Collector and Department of Technology — and that state of operations requires a periodic review every three years.

Project manager Vivian Poe said the office used a two‑step process: reconfirmation questionnaires for the six previously designated departments and a broader online survey plus follow-up meetings for other departments the administrator believed might handle protected health information. Deputy City Attorney Arnulfo Medina, identified in the presentation as the city’s HIPAA expert, was listed as a project partner.

Committee members did not request amendments or public comment on the item before voting to forward it to the full board. The clerk recorded the motion and roll call: Member Sauter, aye; Vice Chair Mahmood, aye; Chair Dorsey, aye.

If the full board accepts the committee referral as presented, the updated designation will be published in the Board of Supervisors agenda packet and the city will document the Controller’s Office, HSH and DATA SF as HIPAA healthcare components under Administrative Code Chapter 22H.