There are several steps a governmental or public-private entity must take when converting from a general HIPAA-covered entity to a hybrid covered entity, said Judith Thompson, deputy city attorney and HIPAA specialist in the Los Angeles city attorney’s office. The steps are:

• Identify “health care components.” This involves differentiating between health care components and business associate-like functions. “The key here is boots on the ground,” said Thompson, who urged governmental representatives not to rely on other departments to conduct this work. “You need to go to the department, you need to interview the personnel, [and] you need to look at the computer screens to see what data they actually are looking at and for what purpose,” she explained. This way, you can give your informed opinion on “whether or not designation as a health care component, and the overall designation of your organization as a hybrid covered entity, is the best approach for your organization.”

• Survey and audit departments, divisions and sections for HIPAA-covered functions.

• Formally designate the hybrid entity choice before the governmental entity’s governing body.

• Create a formal record—an executive order, a council action or a board action—which must be retained pursuant to HIPAA rules.