Some public agencies perform both covered entity functions (e.g. provider, health plan) and other functions (e.g. public health).
These agencies may choose to be hybrid entities, so that the information held by the non-covered component would not be subject to the Privacy Rule.
Special provisions apply; basically, the covered component (provider, health plan) must limit information shared with the rest of the organization the same way that it limits disclosures to other entities.
Specific questions should be addressed to the agency. The agency's privacy official should be of assistance.
Content created by Office for Civil Rights (OCR) Content last reviewed on June 16, 2017
Connect With OCR
Sign Up for OCR Updates
To sign up for updates or to access your subscriber preferences, please enter your contact information below.
Office for Civil Rights Headquarters
U.S. Department of Health & Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free Call Center: 1-800-368-1019
TTD Number: 1-800-537-7697
Divisions of HHS commonly use websites, blog entries, and social media posts to issue communications with regulated parties. While these communications may provide the public with helpful information they cannot, by themselves, impose binding new obligations on regulated entities.