Research components of a hybrid entity that function as health care providers and conduct certain standard electronic transactions must be included in the hybrid entity’s health care component(s) and be subject to the Privacy Rule. However, research components that function as health care providers, but do not conduct these electronic transactions may, but are not required to, be included in the health care component(s) of the hybrid entity. For example, if the university in the example above also has a research laboratory that functions as a health care provider but does not engage in specified electronic transactions, the university as.
