Statement of Everyone’s Harvest HIPAA Covered Entity Status

Everyone’s Harvest has determined that it is a “hybrid entity” for purposes of application of the standards in the federal regulations entitled “Standards for Privacy of Individually Identifiable Health Information” (“Privacy Rule”) (45 C.F.R. Parts 160, 162, and 164) promulgated pursuant to the requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996), codified as 42 U.S.C. §§ 1320d et seq.) As a hybrid entity under HIPAA, Everyone’s Harvest must (among other things) designate its “health care component”. (45 C.F.R. § 164.504(a)(2)(iii)(D).) This Statement is to apprise the public of the hybrid entity determination, and to identify the specific programs that Everyone’s Harvest has designated as covered health care components.

As a hybrid entity under HIPAA, Everyone’s Harvest as a whole is considered a covered entity whose business activities include both HIPAA covered and non-covered functions. In compliance with 45 C.F.R. § 164.504(a)(2)(iii)(D), Everyone’s Harvest has designated: the Fresh Rx Program as a covered health care component within the hybrid entity: All other Everyone’s Harvest programs have been determined by Everyone’s Harvest to be non-HIPAA-covered components of the Department.

This determination was made after a thorough legal and programmatic analysis of the many and varied programs operated by Everyone’s Harvest. Everyone’s Harvest included in the Fresh Rx Program as a covered health care component because the program meets the definition of a covered entity if it was a separate legal entity. This statement could change in the future if certain business practices change in the Fresh RX Program, if new programs are created within Everyone’s Harvest, or if the Fresh Rx Program is terminated.