Regents' Policy Manual - Section 3.8: Institutional HIPAA Compliance Program

Adopted Date: 06-17-2019
Amended: 12-09-2020

Applicability

This policy applies to the “health care components” of the University’s Health Sciences Center (HSC), to other health care components of the University, and to the University’s organized health care arrangement (OHCA).

The University is considered a “hybrid covered entity” because it consists of both health care components and non-health care components. The health care components of the hybrid covered entity are identified in Exhibit A to this policy.  

HIPAA and HITECH

It is the policy of the health care components of the University to establish reasonable administrative, technical, and physical safeguards in an effort to protect the privacy of “protected health information” and “electronic protected health information” that the health care components create, obtain, or maintain, as required by the:

• Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA),
• Health Information Technology for Economic and Clinical Health Act, contained in the American Recovery and Reinvestment Act of 2009 (HITECH), and
• regulations issued by the Department of Health and Human Services with respect to HIPAA (collectively with HIPAA and HITECH, the “HIPAA Standards”).

Self-Insured Health Plans

The University and University Hospitals may sponsor self-insured health plans for the benefit of their respective employees and their dependents, including the UNM Self-Insured Health Plan, the Self-Insured Resident Physician Health Plan, and the Self-Insured Student Health Plan (each, a “Self-Insured Benefit Plan,” and, collectively, the “Self-Insured Benefit Plans”).  The Self-Insured Benefit Plans shall each be considered a “covered entity” within the meaning of the HIPAA Standards.

HIPAA Privacy Officer

The University President has delegated to the Executive Vice President for Health Sciences and Chief Executive Officer of the UNM Health System responsibility for assuring that the University’s health care components identified in Exhibit A comply with the HIPAA Standards.  As part of that responsibility, the Executive Vice President for Health Sciences and Chief Executive Officer of the UNM Health System designates an individual to serve as the HIPAA Privacy Officer for the University’s health care components.

The responsibilities of the HIPAA Privacy Officer include assuring that Exhibit A accurately reflects the University’s health care components. The HIPAA Privacy Officer must notify the UNM Policy Office when Exhibit A should be amended. The UNM Policy Office has authority to amend Exhibit A at the request of the HIPAA Privacy Officer.

Affiliated Corporations

Two affiliated University Research Park and Economic Development Act (URPEDA) corporations that are components of HSC’s clinical arm are separate legal entities and, therefore, their own covered entities within the meaning of the HIPAA Standards.  These URPEDA corporations are integral members of the UNM Health System, as defined in RPM 3.4, and have adopted and implemented their own policies in respect to the HIPAA Standards, consistent with this policy.  

More specifically, UNM Medical Group, Inc. (UNMMG) and any and all clinics operated and/or managed by UNMMG are a covered entity separate from the University, including, without limitation, UNMMG’s provision of third-party administration, medical management, clinical management, network management, and related services in relation to any of the Self-Insured Benefit Plans.

In addition, UNM Sandoval Regional Medical Center, Inc. (SRMC) and any and all clinics operated and/or managed by SRMC are a covered entity separate from the University.  At the same time, any self-insured group health benefit plan sponsored by SRMC for the benefit of SRMC employees and their dependents (the “SRMC Self-Insured Benefit Plan”) is also considered a separate covered entity. 

Organized Health Care Arrangement

The HSC, the Self-Insured Benefit Plans, UNMMG, SRMC, the SRMC Self-Insured Benefit Plan, and the health care components listed in Exhibit A shall take the steps necessary to be considered an OHCA within the meaning of the HIPAA Standards when the parties mutually agree and benefit from joint activities. All components of the OHCA will undertake the steps necessary to comply with the HIPAA Standards.

References

• NMSA 1978, § 21-28-1 et seq. (“University Research Park and Economic Development Act”)
• 42 U.S.C. § 1320d, and as amended by the HIPAA Omnibus rule, effective March 26, 2013 (“The Administrative Simplification Provisions of the Health Insurance Portability and Accountability Act of 1996”)
• Regulations pursuant to HIPAA: 45 CFR, Parts 160, 162, and 164; American Recovery and Reinvestment Act of 2009; Title XIII; Health Information Technology for Economic and Clinical Health Act
• RPM 3.4 (“Health Sciences Center and Services”) 

EXHIBIT A

Amended: 06-19-2020

The University of New Mexico, as a hybrid covered entity under 42 CFR Part 164.504, hereby designates the following operations as health care components for purposes of complying with the HIPAA Standards:

• HSC and its academic and clinical arms (as defined in RPM 3.4, except for UNMMG and SRMC)
• Telemedicine, telehealth, and teleradiology programs (including, without limitation, Project ECHO) on all UNM campuses, hospitals, and clinics
• Counseling Assistance and Referral Services
• Speech and Hearing Sciences
• Any and all Lobo Clinics
• Student Health and Counseling, excluding those activities thereof covered by the Family Education Rights and Privacy Act, 20 USC. § 1232g, as amended
• Office of the University Counsel when accessing or providing health care operational support services in respect to the HSC, the Self-Insured Benefit Plans, and/or to any of the other health care components identified in this Exhibit A
• Safety and Risk Services Department when accessing or providing health care operational support services in respect to the HSC, the Self-Insured Benefit Plans, and/or to any of the other health care components identified in this Exhibit A
• Internal Audit Department when accessing or providing health care operational support services in respect to the HSC, the Self-Insured Benefit Plans, and/or to any of the other health care components identified in this Exhibit A
• Office of Equal Opportunity and the Office of the Title IX Coordinator, when providing services and/or conducting investigations in respect to any of the health care components identified in this Exhibit A
• Applicable Human Resources Departments as follows:
  • of the University, in carrying out and discharging its administration duties in respect to its Self-Insured Benefit Plan 
  • of UNM Hospitals, in carrying out and discharging its administration duties in respect to its Self-Insured Benefit Plan
  • Information Technologies Department of the University, and the HSC, respectively, when accessing or providing mission support services in respect to the HSC, the Self-Insured Benefit Plans, and/or to any of the other health care components identified in this Exhibit A