The Health Insurance Portability and Accountability Act of 1996 (HIPAA) permits an organization that engages in both HIPAA covered and non-covered functions to designate itself as a hybrid covered entity. As a hybrid covered entity, the organization is permitted to place units which engage in activities regulated under HIPAA into a health care component. The units inside the health care component must follow HIPAA regulations; however, the units which are outside the health care component are not bound by HIPAA regulations.The University of Oregon has designated itself as a hybrid covered entity. The following units have been designated to be within the university's health care component:

• University Health Services, including Counseling Services
• Athletics Medicine
• Early Childhood CARES (ECC)
• HEDCO Clinic
• Student Health Insurance Program (SHIP)

Representatives from these areas, as well as the Office of the General Counsel, Information Services, Internal Audit, and Division of Safety and Risk Services make up the membership of the HIPAA Privacy Committee, which works to ensure the confidentiality of protected health information that is created, transmitted, or maintained by the university. In addition, the following university departments are deemed within the covered entity when performing services on behalf of another covered component, and are subject to all applicable confidentiality protections:

• Business Affairs Office
• Information Services
• Division of Student Life
• Office of the General Counsel
• Office of Internal Audit
• Division of Safety and Risk Services
• Office of the Vice President for Research and Innovation, including Research Compliance Services

Questions or Concerns

If you have questions regarding your privacy or wish to file a compliant, please contact the Deputy Privacy Officer for the unit in which you received care.