Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Privacy topic
No spam. Unsubscribe anytime.
Council adopts HIPAA hybrid entity designation to limit townwide training burden
Summary
Council adopted a hybrid covered-entity designation under HIPAA so only departments handling protected health information (fire/EMS and finance/billing) must be trained; town attorneys prepared the policy and council approved it to reduce training costs and narrow compliance obligations.
Town attorneys recommended designating the town as a hybrid entity under the Health Insurance Portability and Accountability Act so that only departments that handle protected health information — principally fire/EMS and finance for ambulance billing — are subject to HIPAA training and procedures.
Paul and staff explained that without the hybrid designation every town employee would technically be subject to HIPAA requirements and corresponding training; the hybrid designation limits mandatory HIPAA training to the two departments that regularly manage medical records and billing. The written policy was prepared by the town’s attorneys and outlines training obligations and the need for a designated HIPAA security/privileged officer in the affected departments.
Councilors asked whether the agreement protects the town if a third-party vendor such as an ambulance-billing company experienced a breach. Staff said covered-business-agreement language and vendor obligations mean a vendor’s breach would be the vendor’s responsibility and that the town would rely on contractual protections and notification obligations. Council approved the hybrid-entity designation policy by voice vote and asked staff to identify the designated HIPAA officer(s) in the fire department.
