Only if the programs provide treatment, bill for it electronically and maintain or create protected health information. Note that if you want only certain parts of the agency to be covered, you would need to organize the agency as a hybrid entity. To become a hybrid entity, the covered entity must designate and include in its health care component all components that would meet the definition of a covered entity if those components were separate legal entities. Within a hybrid entity, most of the HIPAA Privacy Rule requirements apply only to the health care component, although the hybrid entity retains certain oversight, compliance, and enforcement obligations.
