A covered entity (CE) is a health care provider, health plan, or health care clearinghouse regulated by HIPAA. The University of Michigan is a "hybrid" covered entity because some of its units are regulated by HIPAA. Interdisciplinary study teams at U-M may include members both 'inside' and 'outside' the CE: when protected health information (PHI) is accessed, obtained, analyzed etc. by such study teams, then PHI is disclosed during the study. Michigan Medicine Corporate Compliance Office also provides information (requires level-2 login) on Michigan Medicine 'hybrid covered entity'. The graphic below in this section (prepared by Compliance Office) shows that PHI crosses a "PHI Privacy Barrier" when a covered component discloses the PHI for clinical, research or other purposes.
U-M hospital, health centers, and medical school are the main components of the Michigan Medicine CE. Additional health care center components are the School of Dentistry Provider Clinics, Mary A. Rackham (MARI) Institute Provider Clinics, University Health Service, and the U-M Group Health Plan. Generally, faculty and staff (including research staff) in these components handle PHI as part of their jobs, and they are required annually to complete a HIPAA training module from the Corporate Compliance Office.
Additional units at U-M provide "covered functions" for components of the covered entity, supporting the covered entity in its primary functions of treatment, payment and operations (TPO). Faculty and staff from these units who also have hospital or health center responsibilities usually have professional appointments at a U-M 'School' and at UMHS -- for instance, School of Pharmacy faculty often also have 'Clinical Pharmacist' appointments.
Access or exposure to PHI also arises in educational opportunities and training inside the CE for U-M Medical School students, and students at some other U-M schools (e.g. Schools of Dentistry, Nursing, Pharmacy). However, even within these schools not all roles engage with PHI held by the Michigan Medicine Covered Entity (e.g. administrative staff at Medical School Office of Research, and bench scientists).
Graphic: Use inside covered components, and Disclosure to other U-M Units (crossing the "PHI Privacy Barrier")