Designation of the UW–Madison Health Care Component (UW HCC)

Layout for printing

Policy Number:

UW-100

Old Policy Number:

HIPAA 1.1

Responsible Office:

Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:

Covered entity

A health plan, health care clearinghouse, or health care provider that transmits any health information in electronic form in connection with a transaction covered by HIPAA.

Health care component (HCC)

A component or combination of components of a hybrid entity designated by the hybrid entity as covered by HIPAA.

Hybrid entity

A single legal entity that meets the definition of a covered entity, but whose business activities include both HIPAA-covered and non-covered functions, and that designates a health care component.

UW–Madison health care component (UW HCC)

Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA.

Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

HIPAA regulations apply to businesses and individuals in the health care industry such as health plans and health care providers. These are called “covered entities,” meaning they are ‘covered’ by HIPAA. UW–Madison is a “hybrid entity” because the campus includes both units that perform HIPAA-covered functions (such as providing health care) and units that do not.

As a hybrid entity, UW–Madison has designated its units that perform covered functions and individuals or units that perform support functions on behalf of those designated units as its "health care component."

Policy Detail

Units of the Designated UW–Madison Health Care Component

1. School of Medicine and Public Health (SMPH), as outlined below.

   The following units in their entirety:

   1. Anesthesiology
   2. Biostatistics & Medical Informatics
   3. Dermatology
   4. Emergency Medicine
   5. Family Medicine and Community Health
   6. Human Oncology
   7. Medical Physics
   8. Medicine
   9. Neurological Surgery
   10. Neurology
   11. Obstetrics and Gynecology
   12. Ophthalmology and Visual Sciences
   13. Orthopedics and Rehabilitation Medicine
   14. Pathology and Laboratory Medicine
   15. Pediatrics
   16. Psychiatry
   17. Radiology
   18. Surgery
   19. Urology
   20. Carbone Cancer Center
   21. Center for Human Genomics and Precision Medicine
   22. Center for Tobacco Research and Intervention
   23. Institute for Clinical and Translational Research
   24. Wisconsin Alzheimer’s Institute (known as “WAI”)

   25. Clinical Research

       The following “central” SMPH administrative personnel and offices to the extent they perform support functions on behalf of any of the other HCC units:

   26. HIPAA Privacy and Security coordinators
   27. Information technology staff
   28. Risk Management
   29. Senior administrators and their staff
   30. Human Resources
   31. Fiscal Affairs

2. School of Pharmacy, as outlined below.

   The following units in their entirety:

   1. Clinical units

      The following “central” School of Pharmacy administrative personnel and offices to the extent they perform support functions on behalf of any of the other HCC units:

   2. HIPAA Privacy and Security coordinators
   3. Information technology staff
   4. Senior administrators and their staff
   5. Human Resources
   6. Business Office
3. School of Nursing.

4. Waisman Center’s clinics and programs outlined below.

   The following units in their entirety:

   1. Brain Imaging Core
   2. Community Ties Clinic and Program
   3. Waisman Early Childhood Program

   4. Waisman employees and agents who work within any of the UW Health-owned clinics jointly operated by Waisman and UW Health in Waisman space

      The following “central” Waisman Center administrative personnel and offices to the extent they perform support functions on behalf of any of the other HCC units:

   5. HIPAA Privacy and Security coordinators
   6. Information technology staff
   7. Senior administrators and their staff
   8. Human Resources
   9. Fiscal Affairs
   10. Clinical Translational Core (CTC)
5. University Health Services.
6. State Laboratory of Hygiene, excluding the Environmental Testing unit (except for the Clinical Toxicology subdivision of that unit), the Forensic Toxicology unit, the Chemical Terrorism unit, the OSHA Testing unit, the OSHA Consultation Program, and the Labor Statistics Program. 

7. Division of Intercollegiate Athletics (Athletics Department) credentialed health care providers, staff members interacting with protected health information and their support staff.

   The following “central” Division of Intercollegiate Athletics administrative personnel and offices to the extent they perform support functions on behalf of any of the other HCC units:

   1. HIPAA Privacy and Security coordinators
   2. Information technology staff
   3. Senior administrators and their staff
   4. Human Resources
   5. Business Office
8. The following central-campus administrative personnel and offices within the university, to the extent they perform support functions on behalf of any of the HCC units listed above and must access protected health information in performing those support functions. 
   1. Accounting Services
   2. Administrative Information Management Services
   3. Division of Information Technology (including the Office of Cybersecurity, the Help Desk, and Incident Response personnel)
   4. UW-Madison Institutional Review Boards (IRBs)
   5. Office of Compliance
   6. Office of Human Resources
   7. Office of Legal Affairs
   8. Office of Research Compliance
   9. Other individuals or offices may become part of the HCC for limited projects. Such individuals must contact the HIPAA privacy officer if their work necessitates the need to access protected health information prior to such access. 

9. Researchers and other key personnel on human subjects protocols.

   Researchers and other key personnel employed by UW–Madison and holding appointments outside units of the HCC designated above are members of the HCC when they conduct research involving the use of protected health information in collaboration with researchers with appointments in any unit of the HCC designated above. Membership in the HCC lasts for the duration of such research.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties. 

Supporting Tools

Additional information may be found at www.compliance.wisc.edu/hipaa.

Related UW-Madison Policies:

UW-101 Designation of the University of Wisconsin Affiliated Covered Entity (ACE)

Related UW–Madison Documents, Web Pages, or Other Resources:

Compliance: HIPAA

Office of Compliance Policies and Forms

Policy Administration

Approval Authority:

Vice Chancellor for Legal Affairs

Policy Manager:

HIPAA Privacy Officer

Contact:

HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077

Effective Date:

04-14-2003

Revised Dates:

09-22-2014: Effective date of the revised policy: 09-22-2014.
11-29-2017: Effective date of the revised policy: 11-29-2017.
03-26-2020: Effective date of the revised policy: 03-26-2020.
07-14-2020: Effective date of the revised policy: 07-14-2020.
03-30-2021: Effective date of the revised policy: 03-30-2021.
05-17-2021: Effective date of the revised policy: 05-17-2021.
06-14-2022
11-16-2022
05-30-2024

Retrieved:

01-13-2025 15:53:07