HIPAA - Frequently Asked Questions (FAQs) - The University of Oklahoma Health Sciences Center

16. What parts of the University are required to comply with the HIPAA Privacy Regulations?

The University is a "hybrid entity" because its business activities include both covered and non-covered functions. The University engages in education and health care activities. As a hybrid entity, the University is required to designate its "health care components" which are the parts of the University that are required to comply with HIPAA. The University's Health Care Components are:

a. College of Medicine (OU Physicians);

b. College of Medicine - Tulsa (OU Physicians-Tulsa);

c. College of Dentistry;

d. College of Allied Health;

e. College of Pharmacy;

f. College of Nursing;

g. College of Public Health;

h. Goddard Health Center;

i. George Nigh Rehabilitation Institute;

j. the Athletic Department; and

k. the General Clinical Research Center.

The exchange of PHI with a department of the University that is not designated as a Health Care Component is considered a disclosure that must be authorized by the patient.

Clarification:
The purpose of FAQ 16 was to indicate which parts of the University were required to comply with the HIPAA Privacy Regulations. As indicated in FAQ 16, the Privacy Regulations apply to the University's "health care components". The list of health care components in FAQ 16 was not complete. The administrative offices that are required to comply with HIPAA were omitted. In addition to the health care components listed in FAQ 16, the following administrative offices also are required to comply with the Privacy Regulations: (a) the Office of Legal Counsel; (b) the Office of Compliance; (c) Internal Auditing; (d) Financial Services; and (e) the Human Research Participant Protection Program/IRB. Therefore, protected health information may be shared with these administrative offices for operational purposes.