--- title: "45 CFR 164.105 HIPAA: Organizational requirements" canonical: "https://dposchool.com/hipaa/section/164.105" source: "https://www.ecfr.gov/current/title-45/section-164.105" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.105 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart A: General Provisions # 45 CFR 164.105 HIPAA: Organizational requirements eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text **(a)(1)** Standard: Health care component. If a covered entity is a hybrid entity, the requirements of this part, other than the requirements of this section, §§ 164.314, and 164.504, apply only to the health care component(s) of the entity, as specified in this section. #### 45 CFR 164.105(2) **(2)** Implementation specifications: ##### 45 CFR 164.105(2)(i) **(i)** Application of other provisions. In applying a provision of this part, other than the requirements of this section, §§ 164.314, and 164.504, to a hybrid entity: ###### 45 CFR 164.105(2)(i)(A) **(A)** A reference in such provision to a “covered entity” refers to a health care component of the covered entity; ###### 45 CFR 164.105(2)(i)(B) **(B)** A reference in such provision to a “health plan,” “covered health care provider,” or “health care clearinghouse,” refers to a health care component of the covered entity if such health care component performs the functions of a health plan, health care provider, or health care clearinghouse, as applicable; ###### 45 CFR 164.105(2)(i)(C) **(C)** A reference in such provision to “protected health information” refers to protected health information that is created or received by or on behalf of the health care component of the covered entity; and ###### 45 CFR 164.105(2)(i)(D) **(D)** A reference in such provision to “electronic protected health information” refers to electronic protected health information that is created, received, maintained, or transmitted by or on behalf of the health care component of the covered entity. ##### 45 CFR 164.105(2)(ii) **(ii)** Safeguard requirements. The covered entity that is a hybrid entity must ensure that a health care component of the entity complies with the applicable requirements of this part. In particular, and without limiting this requirement, such covered entity must ensure that: ###### 45 CFR 164.105(2)(ii)(A) **(A)** Its health care component does not disclose protected health information to another component of the covered entity in circumstances in which subpart E of this part would prohibit such disclosure if the health care component and the other component were separate and distinct legal entities; ###### 45 CFR 164.105(2)(ii)(B) **(B)** Its health care component protects electronic protected health information with respect to another component of the covered entity to the same extent that it would be required under subpart C of this part to protect such information if the health care component and the other component were separate and distinct legal entities; ###### 45 CFR 164.105(2)(ii)(C) **(C)** If a person performs duties for both the health care component in the capacity of a member of the workforce of such component and for another component of the entity in the same capacity with respect to that component, such workforce member must not use or disclose protected health information created or received in the course of or incident to the member's work for the health care component in a way prohibited by subpart E of this part. ##### 45 CFR 164.105(2)(iii) **(iii)** Responsibilities of the covered entity. A covered entity that is a hybrid entity has the following responsibilities: ###### 45 CFR 164.105(2)(iii)(A) **(A)** For purposes of subpart C of part 160 of this subchapter, pertaining to compliance and enforcement, the covered entity has the responsibility of complying with this part. ###### 45 CFR 164.105(2)(iii)(B) **(B)** The covered entity is responsible for complying with §§ 164.316(a) and 164.530(i), pertaining to the implementation of policies and procedures to ensure compliance with applicable requirements of this part, including the safeguard requirements in paragraph (a)(2)(ii) of this section. ###### 45 CFR 164.105(2)(iii)(C) **(C)** The covered entity is responsible for complying with §§ 164.314 and 164.504 regarding business associate arrangements and other organizational requirements. ###### 45 CFR 164.105(2)(iii)(D) **(D)** The covered entity is responsible for designating the components that are part of one or more health care components of the covered entity and documenting the designation in accordance with paragraph (c) of this section, provided that, if the covered entity designates one or more health care components, it must include any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. Health care component(s) also may include a component only to the extent that it performs covered functions. **(b)(1)** Standard: Affiliated covered entities. Legally separate covered entities that are affiliated may designate themselves as a single covered entity for purposes of this part. #### 45 CFR 164.105(2) **(2)** Implementation specifications—(i) Requirements for designation of an affiliated covered entity. (A) Legally separate covered entities may designate themselves (including any health care component of such covered entity) as a single affiliated covered entity, for purposes of this part, if all of the covered entities designated are under common ownership or control. ###### 45 CFR 164.105(2)(B) **(B)** The designation of an affiliated covered entity must be documented and the documentation maintained as required by paragraph (c) of this section. ##### 45 CFR 164.105(2)(ii) **(ii)** Safeguard requirements. An affiliated covered entity must ensure that it complies with the applicable requirements of this part, including, if the affiliated covered entity combines the functions of a health plan, health care provider, or health care clearinghouse, §§ 164.308(a)(4)(ii)(A) and 164.504(g), as applicable. **(c)(1)** Standard: Documentation. A covered entity must maintain a written or electronic record of a designation as required by paragraphs (a) or (b) of this section. #### 45 CFR 164.105(2) **(2)** Implementation specification: Retention period. A covered entity must retain the documentation as required by paragraph (c)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[68 FR 8375, Feb. 20, 2003, as amended at 78 FR 5692, Jan. 25, 2013\] [45 CFR 164.105 on eCFR](https://www.ecfr.gov/current/title-45/section-164.105) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.105 Previous: [45 CFR 164.104 HIPAA: Applicability](https://dposchool.com/hipaa/section/164.104) Next: [45 CFR 164.106 HIPAA: Relationship to other parts](https://dposchool.com/hipaa/section/164.106) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents