Office for Civil Rights

HIPAA Privacy Rule: Disclosures for Emergency Preparedness - A Decision Tool

Multiple Roles & Responsibilities - Hybrid Entities

• Some public agencies perform both covered entity functions (e.g. provider, health plan) and other functions (e.g. public health).
• These agencies may choose to be hybrid entities, so that the information held by the non-covered component would not be subject to the Privacy Rule.
• Special provisions apply; basically, the covered component (provider, health plan) must limit information shared with the rest of the organization the same way that it limits disclosures to other entities.
• Specific questions should be addressed to the agency. The agency's privacy official should be of assistance.