Title
[Contract] Designation of the City of Sacramento as a Hybrid Entity under HIPAA and Contract for CalAIM Billing and Administrative Services
End
FileID
File ID: 2026-00534
End
Location
Location: Citywide
End
Recommendation
Recommendation: Adopt 1) a Resolution reauthorizing acceptance of Designation of the City of Sacramento as a Hybrid Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and rescinding Resolution No. 2024-0276; and 2) a Resolution a) authorizing the City Manager or designee to execute a contract with Housing for Health California (HHCA) for billing and administrative services for DCR’s participation in the California Advancing and Innovating Medi-Cal (CalAIM) program; b) authorizing the City Manager or designee to execute a related business associate agreement with HHCA as the services include transmitting protected health information; and c) authorizing the City Manager or designee to adjust the revenue and expenditure budgets (Operating Grants, Fund 2702) in the Homeless Housing Initiative (I23001000) multi-year operating project (MYOP) to support homeless-services programs to reflect actual CalAIM reimbursements received.
End
Contact
Contact: Brian Pedro, Director, (916) 808-7816, bpedro1@cityofsacramento.org; Tim Swanson, Assistant Director, (916) 808-7923, tswanson@cityofsacramento.org; Department of Community Response
End
Attachments
Attachments:
1-Description/Analysis
2-HHCA MOU
3-BAA
4-Resolution - Hybrid Entity
5-Resolution - CalAIM Contracts
End
Description/Analysis
IssueDetail
Issue Detail: The Health Insurance Portability and Accountability Act of 1996 (HIPAA Act), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), is a federal law designed to improve the portability and continuity of healthcare coverage, standardize healthcare transactions and implement requirements surrounding health information privacy and security.
In general, HIPAA addresses Protected Health Information (PHI) that is maintained or transmitted by a covered entity. Covered entities are:
• Health plans,
• Healthcare clearing houses, and
• Healthcare providers who transmit health information in electronic form in connection with a transaction covered by a HIPAA-related administrative data standard or other requirement in Title 45 of the Code of Federal Regulations.
The City of Sacramento (“City”) is a covered entity under HIPAA because it conducts certain types of transactions related to health care - primarily the prehospital emergency medical services provided to the public through the Sacramento Fire Department. Nevertheless, most City functions do not involve a connection to those types of transactions. As such, the City performs both covered and non-covered functions. A legal entity that performs both covered and non-covered functions may designate itself a hybrid entity under HIPAA, a designation the City currently holds (Resolution No. 2024-0276).
A legal entity that designates itself as a hybrid entity may choose not to apply the Privacy Rule to its non-healthcare components of the organization. The entity must designate, as part of its covered functions, any component (e.g. department) that would meet the definition of a covered entity, if it were a separate legal entity. All covered healthcare components must comply with HIPAA, and the covered entity retains oversight, compliance and enforcement obligations. (See 45 CFR 164.103 and 45 CFR 164.105.)
The Department of Community Response (DCR) is requesting that the City designate it as a covered health care component under HIPAA to enable it to provide services under the California Advancing and Innovating Medi-Cal (CalAIM) program, which involves the management and transmission of PHI. A multi-year initiative from the State of California’s Department of Health Care Services (DHCS), CalAIM is designed to improve the Medi-Cal program with expanded benefits and a broadened delivery system that makes it more accessible and equitable. People experiencing homelessness are one of CalAIM’s populations of focus; heavy users of emergency rooms are another.
CalAIM enables Medi-Cal Managed Care Plans (MCPs) to couple clinical care with a range of non-medical services, which will be reimbursed by Medi-Cal. These non-medical services, known as Community Supports, are designed to help Medi-Cal members meet critical social needs, including housing-related needs.
In January 2025, DHCS opened an application period for its Providing Access and Transforming Health (PATH) initiative to build up the capacity and infrastructure of on-the-ground entities to successfully participate in the Medi-Cal delivery system. In May 2025, DCR applied for PATH Capacity and Infrastructure Transition, Expansion and Development (CITED) funding to develop and implement a CalAIM program focused on providing Community Supports. In November 2025, DCR was notified that though its application was not approved for the originally applied for PATH CITED funding, DHCS was awarding DCR a related funding opportunity, CITED Intergovernmental Transfer (IGT) funding, in the amount of $336,142, which was accepted by the City (Resolution No. 2026-0007).
As stated in the PATH CITED application as well as the staff report to accept the CITED IGT funding, DCR does not plan to contract directly with a Managed Care Provider (MCP) to implement its CalAIM Community Supports program. Instead, DCR plans to utilize a “hub organization,” which is contracted with local MCPs, for billing and administrative services. Because DCR is a small department with limited FTEs, using a hub-model approach for the CalAIM administrative functions will allow staff to intensely focus their efforts on building and quickly expanding service provision. To that end, DCR recommends the City Council approve a one-year contract with hub organization Housing for Health California (HHCA).
HHCA’s responsibilities will include CalAIM billing and claim services, as well as training and compliance for staff with MCP guidelines and policies under Community Support provisions. In addition to the proposed agreement, DCR will also enter into a Business Associate Agreement with HHCA to ensure that the organization will appropriately safeguard PHI that is created, maintained, or transmitted on behalf of the City in compliance with applicable provisions of HIPAA and the HITECH Act.
As part of the CalAIM reimbursement for Community Support provision, HHCA will be entitled to 10% of the reimbursable amount, with the remainder going to DCR. With the City facing continued budget constraints, the CalAIM Community Support Program will help DCR create a self-sustaining funding source while continuing to support the City’s unhoused community.
DCR’s Community Supports program will standardize and enhance access to several CalAIM services, including Housing Transition Navigation Services, Housing Deposits, Housing Tenancy and Sustaining Services, Day Habilitation Programs and Transitional Rent. Dedicated DCR staff will oversee the provision of these services across the City’s shelter locations as well as within its street outreach program.
End
PolicyConsiderations
Policy Considerations: Pursuant to Sacramento City Code Section 3.04.020, any agreement involving an expenditure of $250,000 or more requires City Council approval.
End
EconomicImpacts
Economic Impacts: Not applicable.
End
EnvironmentalConsiderations
Environmental Considerations: This report concerns administrative activities and government fiscal activities that do not constitute a “project” and are not subject to the provisions of California Environmental Quality Act (CEQA) (CEQA Section 15378(b)(2)). Additionally, pursuant to CEQA Guidelines section 15061(b)(3), these activities are exempt from the California Environmental Quality Act (CEQA) because they do not have the potential for causing a significant effect on the environment.
End
Sustainability
Sustainability: Not applicable.
End
Commission/Committee Action
Commission/Committee Action: Not applicable.
End
RationaleforRecommendation
Rationale for Recommendation: Designating the Department of Community Response as a covered health care component under HIPAA and entering into a contract with hub-organization HHCA will allow DCR to provide reimbursable CalAIM services to people experiencing homelessness and generate additional funds for the department to support ongoing operational needs.
End
FinancialConsiderations
Financial Considerations: The upfront cost of $2,500 for legal services, onboarding, and training; and the optional fees for use of HHCA’s Electronic Health Record System (including a flat fee of $5,000 and monthly fee of $63.33 per user) will be funded from DCR’s FY2025/26 Approved Operating Budget. The 10% fee of the City’s CalAIM reimbursables, excluding housing deposits, will be retained by HHCA from the City’s CalAIM reimbursements that HHCA receives on behalf of the City.
Sufficient funding is available (Measure U Fund, Fund 2401) in DCR’s FY2025/26 Approved Operating Budget, and from anticipated CalAIM reimbursables, to execute the contract with Housing for Health California, with DCR’s total reimbursable amount not to exceed $999,999. As a matter of process, HHCA will first receive the entire reimbursable amount from the MCPs before remitting 90% of that amount to DCR.
End
LocalBusinessEnterprise
Local Business Enterprise (LBE): Not applicable.
End
Background
Background: Covered Entity: A health plan, a healthcare clearing house, or a health provider who transmits any health information in electronic form in connection with a covered transaction. (45 CFR 160.103.)
Covered Function: Those functions of a covered entity of which the performance makes the entity a health plan, healthcare provider, or healthcare clearinghouse. (45 CFR 164.103.)
Hybrid Entity: A single legal entity that is a covered entity whose business activities include both covered and non-covered functions, and that designates its healthcare components, i.e., any that would meet the definition of a covered entity or business associate if it were a separate legal entity. (45 CFR 164.103, 45 CFR 164.105 (a)(2)(iii)(D).)
Healthcare Component: A component, or combination of components, of a hybrid entity. (45 CFR 164.103.)
Business Associate: A person or entity that creates, receives, maintains or transmits protected health information to perform certain functions or activities on behalf of a covered entity, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for a covered entity, and the provision of the service involves the disclosure of protected health information. (45.160.103.)
End