Ohio Administrative Code › Title 3341 - Bowling Green State University › Chapter 3341-3 - Graduate and Under-Graduate Policies › Section 3341-3-84 - HIPAA hybrid entity designation of health care components and administrative responsibilities

Current through all regulations
			 passed and filed through July 1, 2024
(A)
								Policy statement
			 and purpose
Bowling Green state university is
				committed to taking reasonable and appropriate steps to protect the
				confidentiality, integrity, and availability of individually identifiable
				protected health information ("PHI") held by university health care components
				performing functions that are covered by the Health Insurance Portability and
				Accountability Act ("HIPAA") of 1996, as amended, and applicable privacy and
				security regulations.
This policy designates BGSU as a hybrid
				entity under HIPAA; defines the organizational structure and administrative
				responsibilities required by HIPAA; and identifies the privacy and security
				officers and their administrative responsibilities.
(B)
								Identification of
			 health care components
The university is a single legal entity
				that, with respect to HIPAA, performs both covered and non-covered functions.
				The covered functions make BGSU a HIPAA covered entity.
The following university units are
				health care components that perform functions covered by HIPAA: the
				psychological services center and the speech and hearing clinic. Before any
				other university unit performs a HIPAA-covered function, it must first advise
				the provost and the chief information officer, who will amend this policy
				accordingly.
(C)
								Designation as hybrid entity
Most of the university's functions are
				not covered by HIPAA. Accordingly, BGSU designates itself as a hybrid entity
				under HIPAA.
This designation means that only the
				university's identified health care components must comply with HIPAA rules,
				regulations, policies, and procedures.
All other university units must comply
				with the information privacy and security requirements applicable to them, such
				as FERPA.
(D)
								Interactions between university components
The university's health care components
				must treat all other university units as if they were external entities with
				respect to any use or disclosure of PHI.
Any person who performs duties for a
				health care component and another university unit must keep all PHI within the
				health care component. PHI must not be used in or disclosed to the other
				unit.
(E)
								Chief security officer
The university's chief information
				officer is designated as the HIPAA chief security officer for the university's
				health care components and will:
(1)
									Understand the
			 HIPAA security rule and how it applies within each component.
(2)
									Develop
			 appropriate rules and procedures to comply with the HIPAA security rule and
			 provide training as needed.
(3)
									Provide physical
			 safeguards, including physical access controls, appropriate workstation
			 placement and use, and secure device and media disposal or
			 reuse.
(4)
									Provide technical safeguards, including access, audit
			 and authorization controls and communications/network transmission
			 controls.
(5)
									Analyze and manage reasonably anticipated threats to
			 the security and integrity of electronic protected health information ("ePHI")
			 within each component.
(6)
									Ensure availability of ePHI through proper storage,
			 backup, disaster recovery plans, contingency operations, testing, and other
			 safeguards.
(7)
									Protect against unpermitted uses or disclosures of
			 ePHI.
(8)
									Provide a process for prompt reporting of actual and
			 suspected security incidents; respond to and appropriately investigate reported
			 incidents; and maintain security incident tracking reports.
(9)
									Monitor each
			 component to ensure security compliance, including auditing employee
			 information system activity and access reports.