Designation of Hybrid Entity Status and Health Care Component

If a Hybrid Entity exists, this Designation of Hybrid Entity Status should be completed and added to the HIPAA Manual behind Tab I. If this Designation form is used, the Table of Contents should be updated to reflect the addition of this form within Tab I.

WHEREAS, pursuant to the Health Insurance Portability and Accountability Act of 1996, the Department of Health and Human Services (“HHS”) has promulgated Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E (the “Privacy Rules”);

WHEREAS, the Privacy Rules provide that a single legal entity that is a covered entity (as defined in the Privacy Rules) may, by designating itself as a hybrid entity (as defined in the Privacy Rules) and designating its health care component (as defined in the Privacy Rules), avoid application of the Privacy Rules to the portions of itself that are not engaged in functions that cause that single legal entity to be a covered entity;

WHEREAS, [Name of Plan] (the “Plan”) is a covered entity (as defined in the Privacy Rules) that is a single legal entity and it provides both benefits that cause it to be a health plan (as defined in the Privacy Rules) and benefits that are exempt from the application of the Privacy Rules;

NOW THEREFORE, the undersigned, being an authorized officer of [Name of Company] (the “Corporation”), which is the plan administrator and named fiduciary of the Plan, hereby adopts this Designation of Hybrid Entity Status and Health Care Component on behalf of the Plan.

The Plan is hereby designated as a hybrid entity (as defined in the Privacy Rules), effective as of , 20___. The following components of the Plan are hereby designated as the Plan’s health care component:  The self-insured benefits administered on behalf of the Plan by [Name of TPA].  The pharmacy benefits administered on behalf of the Plan by [Name of PBM].  The benefits provided through [Name of HMO, and other benefits alternatives to self-funded option]. The Plan shall adopt and implement policies and procedures providing that, in instances where a person performs duties for both the above-designated health care component and for another component of the Plan, that person will not use for or disclose to any other portion of the Plan any protected health information (as defined in the Privacy Rules) created or received by that person in the course of or incident to that person’s work for the above-designated health care component. IN WITNESS WHEREOF, this Designation of Hybrid Entity Status and Health Care Component is signed on behalf of the Corporation this day of , 20___.