Rules Committee advances ordinance to designate San Francisco a HIPAA hybrid entity

San Francisco's Rules Committee on Feb. 10 advanced an ordinance that would formally designate the City and County of San Francisco as a "hybrid entity" under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Emily Cohen of the mayor's office told the panel the ordinance is intended to clarify which city departments perform HIPAA-covered activities and therefore require HIPAA-level compliance. "The ordinance that we have before you today declares the city and county of San Francisco as a hybrid entity," Cohen said, adding the mayor's office worked with the comptroller, the city attorney and an outside HIPAA consultant to identify functions that should be covered.

Under the legislation, the city administrator's office would prepare a proposed list of covered and excluded departments and submit it to the Board of Supervisors by resolution within 30 days of the ordinance's passage and thereafter no less than every three years. Bill Barnes of the City Administrator's Office said the office would also be responsible for developing and maintaining a citywide HIPAA compliance policy, training and protocols and for facilitating appropriate data sharing between departments.

Proponents said the designation would focus compliance costs and responsibilities on departments that perform health-care-related functions, rather than imposing the full HIPAA burden across city agencies. Cohen and Barnes named the Department of Public Health, the San Francisco Health Plan and the San Francisco Fire Department as likely examples of departments that would perform covered functions.

"This will focus those added layers of cost and responsibility only on those departments that need to meet those requirements," Barnes said, describing a typical scenario in which a paramedic, a hospital and public-health staff need clear rules for sharing patient information.

Supervisor Hillary Ronan said the change was "long overdue" and asked to be added as a cosponsor; Supervisors Catherine Stephanie and Gordon Marr expressed support. Marr moved to forward the ordinance to the full Board with a positive recommendation; the motion passed without objection.

If adopted by the Board, the ordinance would not change state or other federal privacy obligations that also apply to city departments, speakers emphasized. The ordinance would create a governance structure to identify covered units and to update that list by resolution when a department's functions change.