HIPAA Hybrid Entity Designation

HYBRID ENTITY DESIGNATION FOR UNIVERSITY OF VIRGINIA
UNDER THE HIPAA PRIVACY RULE

May 19, 2026

University of Virginia (the “University”) conducts both Covered and Non-Covered Functions and is eligible for treatment as a Hybrid Entity under the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA Privacy Rule”). The University, therefore, has surveyed its divisions and activities to identify its Covered Functions and to designate its Health Care Components under the HIPAA Privacy Rule.

The University Compliance Office, the Office of University Counsel, and the University Medical Center Corporate Compliance and Privacy Office identify and confirm the following are and have been Covered Functions of the University under the provisions of the HIPAA Privacy Rule:

Covered (Health Care) Functions:

I. Covered Entity Components

All personnel of Covered Entity Components are subject to HIPAA.

College at Wise – UVA Student and Employee Health Wise Clinic
Medical Center
School of Education and Human Development – Sheila Johnson Center, excluding McGuffey Reading Services
School of Education and Human Development – Department of Kinesiology Research Laboratories
School of Medicine
School of Nursing
Student Health and Wellness *
UVA Health Plan

* While Student Health and Wellness is a ‘covered entity’ under HIPAA, the records it maintains are governed by FERPA and/or state law and are not ‘PHI’ under HIPAA; however, Student Health and Wellness is subject to the HIPAA Administrative Simplification provisions.

II. Business Associate Components

Personnel of University departments and divisions, including those listed below, are Business Associate Components to the extent they provide Business Associate services (using or disclosing protected health information) to those University Covered Entity Components listed above, in the course of the Covered Entities’ health care provider treatment, payment and health care operations or health plan activities under HIPAA. Business Associate Components typically perform functions related to health care operations on behalf of the Covered Entity components. “Health care operations” are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment.

Audit and Compliance
Board of Visitors – all BOV members and any applicable committee members and staff
Center for Survey Research
Claude Moore Health Sciences Library
Environmental Health & Safety
Equal Opportunity and Civil Rights
External Relations – employees who support the Health System
Facilities Management – employees who support recycling and surplus property
Human Resources – employees who support the UVA Health Plan and Employee Relations staff who support Covered Entity Components
Information Technology Services (ITS) – Academic Division technical support for health care components, UVA Health Plan, and Research Computing
McCue Center
Office of Vice President for Research – including Institutional Review Board for Health Sciences Research and Post Approval Monitoring Program
Office of the Executive Vice President and Chief Operating Officer
Office of the Executive Vice President for Health Affairs
Office of the Executive Vice President and Provost
Office of the President
Office of the University Counsel
Office of the University Ombuds
Procurement Services
Property & Liability Risk Management
Records & Information Management
University Communications
UVA Health Foundation

Non-Covered Functions:

All divisions and activities of the University that are not explicitly designated as Covered Functions are designated as Non-Covered Functions of the University.

Affiliated Covered Entity (ACE)

Legally separate covered entities that are affiliated may designate themselves as a single covered entity for purposes of the HIPAA privacy rule. Under this affiliation, the organizations share one notice of privacy practices. To be an ACE, the separate covered entities must be under common ownership or control.

“ACE” – shall mean the “Affiliated Covered Entities” (as such term is defined in 45 C.F.R. §164.105(b)) consisting of:

The Covered Entity Components, including (a) UVA Medical Center (“UVAMC”); (b) UVA School of Medicine (“SOM”); (c) UVA School of Nursing (“SON”); and such other Covered Entity Components named as such in the University of Virginia’s Hybrid Entity Designation from time to time;
The Affiliated Covered Entities named in the University of Virginia’s Hybrid Entity Designation from time to time, including but not limited to University of Virginia Imaging, LLC; Community Medicine University of Virginia, LLC; Monticello Community Surgery Center, LLC d/b/a UVA Health Surgery Care Riverside;
The Covered Entity affiliates of UVA Community Health, Inc. (“UVACH”), including: (a) UVA Culpeper Medical Center d/b/a UVA Health Culpeper Medical Center; (b) UVA Prince William Medical Center d/b/a UVA Health Prince William Medical Center; (c) UVA Prince William Medical Center d/b/a UVA Health Haymarket Medical Center; (d) UVA Community Health Medical Group, LLC; (e) UVA Outpatient Imaging Centreville, LLC; and (f) UVA Cancer Center Gainesville, LLC; and
Each of such entities’ respective Covered Entity operating entities, affiliates and subsidiary organizations, whether now existing or later created or acquired.

Organized Health Care Arrangement (OHCA)

Because many healthcare settings are clinically integrated but are separate legal entities not commonly owned or controlled, the HIPAA privacy rule also permits providers that typically provide healthcare to a common set of patients to designate themselves as an OHCA for purposes of HIPAA, which permits the use of a joint notice of privacy practices and provides the ability to share protected health information throughout the OHCA for treatment, payment, and healthcare operations.

“OHCA” – shall mean the Organized Health Care Arrangement (as such term is defined in 45 C.F.R. §160.103) consisting of:

The entities that comprise the Health System’s ACE established pursuant to this Policy;
The University of Virginia Physicians Group (“UPG”); and
Such other non-controlled Covered Entities as may (i) participate in the UVAMC Epic electronic health record (“EHR") or in other joint quality assurance or utilization review activities and/or share financial risk with one or more of the entities described above; and (ii) enter into an agreement with UVAMC pursuant to which such Covered Entities agree to hold themselves out as part of the Health System’s OHCA and to comply with the requirements of this Policy.

This designation is effective as of May 19, 2026.