Medical Records and the Law

152 CHAPTER 6: ACCESS TO HEALTH INFORMATIONother company, are under common ownership. Unrelated organizationsmay not become ACEs, because DHHS believes that their informationpractices will be too dissimilar. 197Organizations become “affiliated” when they designate themselves asingle entity for purposes of complying with the rules. For example,several hospitals under common control might designate themselves asan ACE. A healthcare component of a hybrid entity also may affiliatewith another covered entity. 198 ACEs commonly establish joint privacyand security policies, procedures, and forms, 199 and must use a singlenotice of privacy practices. 200 (See the discussion of the notice of privacypractices later in this chapter.) In considering whether to form anACE, organizations that operate in more than one state should evaluatewhether it will be practical for them to use a single form of notice.Because they are treated as one covered entity, ACEs may also sharePHI without having to enter into business associate agreements. (Seethe discussion of business associates later in this chapter.) The rules arenot clear as to whether, as one covered entity, ACEs must present oneresponse to individuals seeking to exercise their various HIPAA rights,or whether each covered entity in the affiliated group must relate tothose individuals. If the ACE chooses to coordinate its response withrespect to individual HIPAA rights, it should make this clear in its noticeof privacy practices.However, each covered entity in an affiliated group retains responsibilityfor its compliance with the rules. 201 If a covered entity performsmultiple covered functions (for example, those of a healthcare providerand those of a health plan), it must comply with all the rules applicableto each function. 202 If an individual relates to the covered entity foronly one of its covered functions, the entity may use or disclose the individual’sPHI only in connection with that function. 203 Thus, if organizationsin the ACE operate different covered functions, they willbe able to share an individual’s PHI only if the individual has a relationshipwith each function.19765 Fed. Reg. 82637 (Dec. 28, 2000).19845 C.F.R. § 164.105(b)(2)(i)(A).199See, generally, 65 Fed. Reg. 82637 through 82640 (Dec. 20, 2000).20065 Fed. Reg. 82552 (Dec. 20, 2000).20165 Fed. Reg. 82503 (Dec. 20, 2000).20245 C.F.R. § 164.504(g)(1).20345 C.F.R. § 164.504(g)(2).