The HIPAA Privacy Final Rule*, as amended August 14, 2002, is applicable to “covered entities” who are; 1) health plans, 2) health care clearinghouses, and 3) those health care providers who transmit electronically any of the transactions covered by the EDI Transactions and Code Set Final Rule. The framers of the HIPAA Privacy Rule recognized that in certain circumstances organizations meeting the criteria of covered entity might not be simple organizations or companies, but rather conglomerates of one sort or another which may include one or more components within the larger organization that performs a health care function covered by the Privacy Rule. For example, large insurance companies with many product lines such as life insurance, auto insurance and home owners insurance – none of which have anything to do with heath care – might also have a portion of the business offering health insurance coverage. In such a case, it would make no sense for the larger insurance company to implement HIPAA Privacy policies and procedures and train all employees, in both the health care and non-health care segments, on the HIPAA Privacy issues that pertain only to the health insurance portion of the business.

Thus, the Privacy Rule allows for what is defined in the Privacy Final Rule as a “hybrid entity” allowing such organizations to formally designate the component, or components, within the larger organization that comprise the health care functions which must comply with the HIPAA regulations, as well as, disallowing protected health information from being disclosed to the non-health care components of the larger business or organization.

The District of Columbia is one such organization. That is, the District is a very large organization whose principal business or function is not health care but which has several health care components. Hybrid entity means a single legal entity:

(1.) That is a covered entity;
(2.) Whose business activities include both covered and non-covered functions; and
(3.) That designates health care components in accordance

The District of Columbia is implementing compliance for the following Participating Agencies and Associated Health Care Components.


* This document is presented in Portable Document Format (PDF) and a PDF reader is required for viewing.
Download a PDF reader or learn more about PDFs.