The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) permits an organization that engages in both HIPAA covered and non-covered functions to designate itself as a hybrid covered entity. As a hybrid covered entity, the organization is permitted to place areas which engage in activities regulated under HIPAA into a health care component. The areas inside the health care component must follow HIPAA regulations; however, the areas which are outside the health care component are not bound by HIPAA regulations.
The University of Louisville has designated itself as a hybrid covered entity. The following areas have been designated to be within the University of Louisville health care component.
* Department of Athletics - subdivision which processes the level-funded insurance plan offered to student athletes
* Department of Audit Services
* Department of Environmental Health & Safety
* Department of Risk Management
* Department of University Advancement/Development – subdivision which performs fundraising activities
* Get Healthy Now
* Human Resources - subdivisions which process employee health plan (e.g., Benefits)
* Information Security Office
* Information Technology Department
* Office of Communications & Marketing
* Office of Finance/Controller – subdivisions of the Controller’s Office which process health care related payments
* Office of University Counsel
* School of Dentistry and affiliated Institutes and Centers
* School of Medicine and affiliated Institutes and Centers (includes Campus Health, Health Promotion Center, and the Prevention, Education, and Advocacy on Campus and in the Community (PEACC) Program; excludes all research activities)
* School of Nursing
* UofL Care Partners
* University Archives & Records – the subdivision which handles and/or stores protected health information
* University Integrity & Compliance Office
* University Privacy Office.
Revised February 5, 2019