You may have heard your health department being referred to as a “hybrid entity” and wondered what that term means, or you may have seen the designation HIPAA hybrid entity in materials from partner agencies.

This fact sheet is intended to provide a general overview of what a HIPAA hybrid entity is and some of the high-level considerations for state, Tribal, local, and territorial (STLT) health departments to assess when determining whether to become a hybrid entity. It is not intended to cover the various complexities that arise with hybrid entities, which should be assessed in consultation with a health department’s leadership, legal, and compliance teams.

  • What is a HIPAA hybrid entity?

    The term “hybrid entity” comes from the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a federal law that created national standards for electronic health care transactions. The law also incorporated privacy protections applicable to protected health information, or PHI.1 HIPAA applies to “covered entities,” which it defines as a health plan, health care clearinghouse, or health care provider.2 Typically, HIPAA applies to the entire organization unless the organization designates itself as a hybrid entity. A hybrid entity is a single legal entity that is generally covered by HIPAA but whose business activities include both covered and non-covered functions under HIPAA.

    Most health departments typically perform both covered and non-covered functions. For example, a newborn screening program may be designated as a HIPAA-covered healthcare component of a HIPAA hybrid entity, while the department that reports vital events, such as births or deaths would not be covered by HIPAA.3 To become a hybrid entity, an organization must officially designate its covered and non-covered components, which then allows HIPAA to apply only to the HIPAA covered functions the organization performs.4

     

    1 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 100 Stat. 2548; see also HIPAA for Professionals, U.S. Dep't of Health & Hum. Servs. (July 19, 2024), https://www.hhs.gov/hipaa/for-professionals/index.html [https://perma.cc/G6KK-7TKR].

    2 45 C.F.R. § 160.103 (2025). Note that HIPAA only applies to health care providers who transmit health information in electronic form in connection with a HIPAA covered transaction. For practical purposes, this covers most health care providers.

    3 For an example of the types of activities that are designated as covered by HIPAA, see the list of HIPAA-covered healthcare components on the California Department of Public Health’s website, available at https://www.cdph.ca.gov/Programs/OLS/Pages/HIPAA-Covered-Healthcare-Components.aspx.

    4 45 C.F.R. §§ 164.103, 164.105 (2025). Note that the designation must include within its covered components those parts of the organization that meet the definition of a covered entity or business associate.

  • Why do health departments become HIPAA hybrid entities?

    The main advantage for public health departments to become hybrid entities is the ability to use and disclose data pursuant to state and local laws, regulations, and internal policies as opposed to HIPAA. Ensuring the confidentiality of protected health information is a duty that health departments take extremely seriously. Health departments must appropriately guard the confidentiality of protected health information; however, in contrast to HIPAA, state public health law may allow for greater flexibility when conducting public health investigations, in turn leading to more effective disease control efforts. Therefore, an agency’s status as a hybrid entity affects which laws apply to its public health data and which laws the agency relies upon to establish data sharing relationships with other entities.

    While HIPAA was not intended to limit traditional public health activities,5 an unintended consequence has been that it can restrict epidemiologic surveillance and research that improves and protects the public’s health.6 For example, HIPAA might limit a health department’s ability to disclose certain information through contact tracing activities as part of a disease investigation where the individual (e.g., a close contact of someone with an infectious disease) receiving the information is not another public health authority.7 In this example, the health department may not be able to disclose enough information about potential exposure because the recipient of that information may be able to reidentify the subject. As a consequence, a health department may need a HIPAA authorization, which may not be practical depending on the scope and scale of a potential outbreak.

    Another advantage of becoming a hybrid entity is reducing HIPAA’s footprint within an organization, thereby reducing HIPAA’s compliance burden. Only the HIPAA covered components of a hybrid entity must comply with HIPAA’s privacy, security, and breach notification rules. For example, if an unauthorized disclosure of PHI occurs, HIPAA’s breach notification rule would only apply to the HIPAA covered components of the organization. The breach notification rule includes standards for how an organization must assess and respond to a breach, including reporting breaches to the federal Office of Civil Rights (OCR), which is responsible for enforcing HIPAA and has the authority to impose civil monetary penalties and/or compliance requirements.8 Reducing HIPAA’s footprint within an organization thus minimizes risk and liability.

    5 See 45 C.F.R. § 164.512(b) (2025) (HIPAA’s public health exception).

    6 Daniel Wartenberg & Robert Wood Johnson, Privacy Versus Public Health: The Impact of Current Confidentiality Rules, 100 Am. J. of Pub. Health 407-12 (2011), http://doi.org/10.2105/AJPH.2009.166249 [https://perma.cc/VKQ6-RC2V]; see also Issue Brief, An Overview on Conducting HIPAA Hybrid Entity Assessments for Local Public Health Departments, Network for Public Health Law (April 1, 2024) available at https://www.networkforphl.org/resources/an-overview-on-conducting-a-hipaa-hybrid-entity-assessment-for-local-public-health-departments/ [https://perma.cc/53PH-5K9S] (last visited Apr. 21, 2026).

    7 This is the case even though health departments typically would not provide individually identifiable information to close contacts because it may be fairly easy for close contacts in a disease investigation to figure out who the individual is. Such reidentification risk may run afoul of HIPAA’s privacy protections for PHI or require a HIPAA compliant authorization before making the disclosure. See 45 C.F.R. §§ 164.500-535.

    8 See Enforcement Data, U.S. Dep't of Health & Hum. Servs. (March 22, 2010), https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/index.html [https://perma.cc/KB4M-67VN].

  • What are the steps to becoming a HIPAA hybrid entity?

    The main step to becoming a HIPAA hybrid entity is for the organization to designate itself as such, including naming its HIPAA covered components or programs, through a policy or other documentation.9 To make such a designation, the organization will need to assess each program area with sufficient detail to document whether that program meets the definition of a covered entity or business associate under HIPAA. The assessment results should be documented and maintained in a manner that is consistent with HIPAA’s requirements. The organization will also need to review and potentially update its internal policies and procedures, as well as its privacy and security trainings, to determine how to instruct and train its workforce to comply with HIPAA or other laws as appropriate.

    9 45 C.F.R. § 164.105 (2025).

  • What are the potential challenges related to becoming a HIPAA hybrid entity?

    One of the challenges to establishing a HIPAA hybrid entity is that it is resource intensive. As described above, an assessment of the entire organization must be performed and documented to determine which components of the organization are covered by HIPAA.

    Internal policies, procedures, and trainings must also be assessed and updated as needed based on the assessment results. The organization may need HIPAA and non-HIPAA policies and procedures to address the privacy and security of data across the organization. Likewise, privacy training needs may differ across the organization for HIPAA and non-HIPAA purposes. For example, HIPAA covered components of the organization must comply with HIPAA when disclosing protected health information to a non-covered component of the organization.10

    Finally, the organization will need to work closely with program areas that perform both covered and non-covered functions to ensure that staff understand their roles and obligations.11

    10 HIPAA requires that a covered component disclose PHI to a non-covered component in compliance with HIPAA as if the two were separate and distinct legal entities (e.g., as if making the disclosure to an entity external to the organization). 45 C.F.R. 164.105(a)(ii)(A) (2025).

    11 45 C.F.R. § 164.105 (2025).

  • Additional Resources

  • Questions?

    For legal technical assistance on public health data sharing agreements reach out to Manel Kappagoda (manel.kappagoda@mitchellhamline.edu) or Tom Pryor (tom.pryor@mitchellhamline.edu) at the Public Health Law Center. This resource is part of a series of factsheets prepared by the Public Health Law Center.

    The development of this resource was supported by the Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services (HHS) as part of a financial assistance award totaling $949,000 with 100 percent funded by CDC/HHS. The contents are those of the authors and do not necessarily represent the official views of, nor an endorsement, by CDC/HHS, or the U.S. Government.