R417RESOLUTION OF • OF OF
KENNEDALE,
KENNEDALE, TEXAS AS A HYBRID ENTITY FOR THE
PUTPOSES OF
WHEREAS, the federal government enacted the Health Insurance Portability and Accountability
Act of 1996 ( HIPAA) and the Health Information Technology Economic and Clinical
Health Act of 2009 (HITECH) to protect patient health information; and
WHEREAS, HIPAA and HITECH allow entities that perform covered and non - covered functions
to designate themselves as Hybrid Entities; and
WHEREAS, a Hybrid Entity is defined as a single legal entity that performs both HIPAA covered
and non - covered functions that designates health care components in accordance with
45 CFR part 164; and
WHEREAS, the City has determined that it performs both covered and non - covered functions;
and
WHEREAS, in order to designate itself a Hybrid Entity, the City must designate and document
components of the City that are health care components; and
WHEREAS, the City will enact safeguards to prevent disclosure of PHI to another component of
the covered entity where HIPAA would prohibit disclosure if the two were separate legal
entities; and
WHEREAS, after thoughtful consideration the City believes it is in its best interest to declare
itself a Hybrid Entity.
NOW, THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF
KENNEDALE,TEXAS:
SECTION 1.
The City of Kennedale City Council hereby designates the City a Hybrid Entity pursuant to 45
CFR 164.103 and 164.105.
The following are considered health care components of the City:
a. The Human Resources in its function administering the City's health insurance benefits
plans for medical, dental, vision, and health flexible spending plans only. This
designation does not extend to the Human Resources Department's other functions,
including but not limited to its administration of the City's workers' compensation and
voluntary disability benefits programs, its personnel management, and its hiring and
disciplinary roles.
The Finance Department in its function involving the billing, payment and administration
of health insurance payments for medical, dental, vision, and health flexible spending
plans only, which if provided external to the City, would make it a business associate for
HIPAA purposes. This designation does not extend to other financial work performed by
the finance department, including, but not limited to, payments relating to the City's
workers' compensation and voluntary disability benefits programs.
c. The Fire Department with respect to its provision of emergency medical services only.
This designation does not extend to other work performed by the Fire department,
including providing services as part of the City's workers' compensation program or fire
response, inspection and investigatory activities.
d. The Information Technology department with
technology services for the City's health care
and health flexible spending plans and the
services which if provided external to the City
HIPAA purposes.
respect to its duties relating to providing
benefit plans for medical, dental, vision,
Fire Department's emergency medical
would make it a business associate for
SECTION 3.
The City Manager or his /her designee is hereby designated as the City's Privacy Officer to
implement and coordinate the City's compliance with the privacy rule. The Fire Chief or his /her
designee will act as the Privacy Officer for emergency medical services.
SECTION 4.
The City shall institute safeguards and policies to ensure that:
a. Each designated health care component shall not disclose PHI to another non - health
care component of the City in any circumstance in which HIPAA and prohibited such a
disclosure if the health care component and non - health care component were separate
and distinct legal entities.
b. Designated health care components shall not use or disclose PHI that it creates or
receives from or on behalf of the health care component in a way that is prohibited by
HIPAA's privacy standards and shall comply with HIPAA's security standards.
c. If an employee performs duties for both a health care component and non - health care
component of the City, the employee shall not use or disclose PHI created or received in
the course of or incident to his or her work for the health care component in a way
prohibited by the HIPAA privacy and security standards.
61 :1011 us] LI�U
This resolution shall be effective upon its approval bv the City Council.
APPROVED this 5th day of November, 2013.
/\PPR{J\/EO'
john
or Clark
M / Y '
Amethyst G. Cir�ho, City Secretary