HIPAA at UT

The University of Tennessee is considered a hybrid entity under HIPAA, meaning it carries out both covered and non-covered functions. This designation allows the university to limit how HIPAA rules apply across our operations, while still ensuring full compliance where required.

When protected health information (PHI) must be shared with external parties, such as vendors or service providers, the university uses a Business Associate Agreement to ensure that those parties follow the same federal standards for safeguarding information.

To support our compliance efforts, the UT System has appointed dedicated HIPAA privacy and security officers. Contact information and helpful resources are provided below.