As an employer is my city subject to the HIPAA privacy and security rules?
No. As an employer, the city is not subject to the HIPAA privacy and security rules. However, keep in mind that many cities sponsor a group health plan of some sort, so the city as a sponsor of those plans would likely be a covered entity. The city will also need to make sure that there is adequate separation between its employment-related functions and the group health plan functions to ensure that information from the group health plan is not used for making employment related decisions. Many cities conduct certain functions that may fall under HIPAA and other functions that do not fall under HIPAA (e.g. health plan functions and employer/HR functions). Each of these functions may be treated separately in what is called a hybrid entity. A hybrid entity is an entity that has some covered and some non-covered functions (ยง164.504 discusses hybrid entities and their responsibilities). HIPAA dictates that the covered functions must act (in regards to protected health information) as if th
