Health Insurance Portability and Accountability Act/Health Information Technology for Economic and Clinical Health (HITECH)

Penn State is a hybrid entity; only parts of Penn State are subject to HIPAA and/or HITECH.  HITECH applies to electronic health information and the dissemination thereof. The parts of Penn State that are regulated under HIPAA  are referred to as covered components. The University has identified which of its specific units are covered components. Covered components are specified as a health care provider that conducts certain transactions in electronic form, a health care clearinghouse, or a health plan.  For more information regarding whether or not your unit would meet the definition of a covered component under HIPAA, refer to the U.S. Department of health and Human Services.

The Privacy Officer, serves as the HIPAA Privacy Compliance Officer, responsible for the development and implementation of the policies and procedures required to comply with the HIPAA Privacy Rule. In addition, each identified covered component must participate in the ongoing compliance of HIPAA and must assign a representative to coordinate regulatory compliance and implementation with their unit. 

Note:  The Milton S. Hershey Medical Center and the Penn State College of Medicine  have been joined together as an "Affiliated Covered Entity" and act as one for the purposes of HIPAA. The Hershey Medical Center has it's own privacy officer and one set of materials and procedures used to comply with HIPAA. If faculty, staff, or students are  participating in any activity that involves patient information from the Milton S. Hershey Medical Center, it will be necessary to follow the privacy and security policies of the medical center.

HIPAA Complaint Form 

The Privacy Office is responsible for the implementation and administration of an institutionally based complaint process in compliance with the rules and regulations of HIPAA.  Patient complains may be made directly to the Penn State Privacy Office or to the Office for Civil Rights if they believe their privacy rights have been violated.  

To file a complaint with the Penn State Privacy Office, please print and complete the Health Information Privacy Complaint Form. Mail the completed form to: 

Chief Privacy Officer, Penn State Privacy Office, 333 James M. Elliott Building, University Park, PA 16802

You may also file a complaint directly to the Office for Civil Rights.