ÐÇ¿Õ´«Ã½

Research subject to the Health Insurance Portability and Accountability Act (HIPAA) must comply with ÐÇ¿Õ´«Ã½â€™s policies and procedures for HIPAA.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) went into effect on April 14, 2003, to:

• Promote the portability of insurance coverage as employees moved from job to job;
• Increase accountability and decrease fraud and abuse in healthcare; and
• Improve the efficiency of the healthcare payment process, while protecting a patient's privacy.

HIPAA applies to "Covered Entities," defined by the Privacy Rule as:

• A healthcare provider that conducts certain transactions in electronic form,
• A healthcare clearinghouse,
• A health plan, or
• A business associate (person or organization) performing a function on behalf of the Covered Entity for which access to protected health information is needed.

Because ÐÇ¿Õ´«Ã½ has at least one department that provides healthcare services and electronically transmits health information, it is considered a Covered Entity.

ÐÇ¿Õ´«Ã½ As A "Hybrid Entity"

Since the primary function of ÐÇ¿Õ´«Ã½ is not to provide healthcare, ÐÇ¿Õ´«Ã½ is permitted to designate itself as a "hybrid entity," which allows it to apply the Privacy Rule only to those parts of ÐÇ¿Õ´«Ã½ that, if standing alone, would be a Covered Entity. As a hybrid entity, ÐÇ¿Õ´«Ã½ must designate its "healthcare components," which includes departments that provide support for healthcare components.

Healthcare components at ÐÇ¿Õ´«Ã½ are:

• ÐÇ¿Õ´«Ã½ School of Dental Medicine
• ÐÇ¿Õ´«Ã½ School of Dental Medicine Faculty Practice
• ÐÇ¿Õ´«Ã½ Student Self-Insured Health Plan and Optional Dependent Medical Plan
• ÐÇ¿Õ´«Ã½ Employee Health Plan
• ÐÇ¿Õ´«Ã½ Postdoctoral Benefits Program
• Prion Disease Pathology Surveillance Center
• ÐÇ¿Õ´«Ã½ Frances Payne Bolton (FPB) School of Nursing Clinical Practice

ÐÇ¿Õ´«Ã½ Policies and Procedures for HIPAA

Learn more about HIPAA at ÐÇ¿Õ´«Ã½. 

HIPAA and Research

A researcher who obtains Protected Health Information (PHI) from a Covered Entity (whether at ÐÇ¿Õ´«Ã½, University Hospitals of Cleveland, the MetroHealth System, the Louis Stokes Cleveland Veterans Affairs Medical Center, Cleveland Clinic or from some other Covered Entity) or creates new PHI through the Covered Entity will need to comply with the Privacy Rule. ÐÇ¿Õ´«Ã½ and its affiliated hospitals empower their Institutional Review Boards (IRBs) to act as Privacy Boards on behalf of each Covered Entity. For example, the MetroHealth IRB also acts as MetroHealth's Privacy Board for research purposes.

For more information on how to meet each institution's HIPAA requirements, please click on the link for the appropriate IRB below:

• ÐÇ¿Õ´«Ã½ IRB 

Other Resources on HIPAA

• Definition of PHI and the 18 identifiers considered to be PHI under HIPAA

ÐÇ¿Õ´«Ã½ HIPAA Contacts