If a city pays for resident telehealth, does it become a HIPAA covered entity? For TAP Health, TAP is the covered entity for the visit. The city may see enrollment or opt-out files, not diagnoses, chats, or visit notes.
Last reviewed: September 2026.
Who is a HIPAA covered entity?
HHS lists three kinds: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a standard transaction. See HHS: covered entities and the Privacy Rule overview.
A city that only funds a vendor and never treats patients is usually not a health care provider. A city that runs a group health plan for employees can be a covered entity for that plan. Do not copy the analysis from one program onto the other.
HHS also explains business associates: persons who handle protected health information for a covered entity (HHS: business associates). If the city never receives visit-level PHI, it is not acting as TAP’s business associate for clinical records. If a proposed contract would send notes to city hall, stop and rewrite the data flow.
What should the city receive, and what should it not?
| Data | City | Clinical vendor (TAP) |
|---|---|---|
| Household eligibility, address, opt-out flag | Yes, as needed to bill or to honor a decline | Yes, to know who may be seen |
| Visit notes, diagnoses, prescriptions, chat logs | No | Yes, as the treating provider |
| Aggregate counts (encounters, rating, claims avoided) | Yes, de-identified or limited as the contract allows | Yes |
| 911 CAD and fire records | Yes, those are already city records | No, unless the city later shares a limited, lawful extract |
TAP’s public proof points (93% of encounters resolved without another claim; 9.9/10 resident rating; 780+ public-sector partners) are aggregate, not a reason to export a resident’s chart to the manager’s office.
Does a utility-bill program change HIPAA?
A name, service address, and a line item on a water bill are utility records, not a medical record. A program fee on the bill does not, by itself, make the water clerk a covered-entity workforce member.
Still keep the bill language boring. Do not print a diagnosis, visit date, or clinician name on the stub. Algonquin, Illinois kept 70% of households after a notice and decline window. That is an enrollment result, not a HIPAA finding.
An opt-out that mentions a specific condition is clinical. It belongs in the vendor’s system, not the utility CIS notes field.
What about Open Records and council packets?
State public-records laws are not HIPAA; they can be stricter, looser, or just different. Assume a resident will request “all records about the telehealth program.” Build the file so the responsive set is contracts, notices, aggregate stats, and invoices, and so visit notes are not there to begin with.
Do not put a named resident’s encounter in a council slide. Ferris, Texas: 20% fewer non-emergent EMS runs and more than 50% adoption, per City Manager Brooks Williams. A city-level result that needs no patient list in the packet.
What should IT ask the vendor?
- Where is clinical data hosted, and who can open a chart?
- Does any city account have a production login to visit notes? It should not.
- How are enrollment files transferred (SFTP, encrypted email, a portal)?
- What is the breach-notice path, and who notifies residents?
- Is there a BAA, and for which data? One that covers visit notes for the city is a warning sign, not a trophy.
HHS’s security-rule materials sit on the same professional pages; use them for vendor review.
Where do people over-claim?
- “The city is never subject to HIPAA.” False if the city also sponsors a group health plan, runs a clinic, or handles PHI as a business associate.
- “HIPAA blocks any city report.” False. Aggregate and de-identified reporting is how Ferris-style EMS results get discussed in public.
- “A BAA makes the city a covered entity.” No. A BAA is for a business associate of a covered entity.
- “Resident telehealth and employee benefits are the same legal file.” They are not. Split the memos.
This page does not replace counsel. The HHS pages above are the primary federal source; state medical-privacy statutes may add duties.
How should savings show up without PHI?
Use city-owned CAD and finance data for EMS cost. TAP’s modeled range of $450 to $900 per avoided non-emergency dispatch is a cost-to-serve estimate: local fully loaded cost per response times low-acuity calls you can defend. Pair it with observed, named results (Ferris 20%; Algonquin 70% retention) that need no chart export.
Need a counsel-ready data-flow one-pager?
If your attorney wants the covered-entity map and the “what city hall never sees” list on one page, start here: Partner with TAP Health.
