Entity profile and covered-entity / business-associate determination

Granite City Family Dental — Entity profile and HIPAA determination. Version 1.0. Effective November 1, 2026. Approved by Dr. Maria Lindqvist, Owner.

Authority: 45 CFR 160.103 (definitions of covered entity, business associate and protected health information); 45 CFR 164.105 (hybrid and affiliated entities); 45 CFR 164.103.

1. Purpose

This document records who Granite City Family Dental is for HIPAA purposes, where it operates, which systems hold protected health information (PHI), and why the HIPAA rules apply to it. Every other policy in this binder is built from the facts on this page. When any fact here changes (a new location, a new EHR, a new line of business, a change of ownership) the Privacy Officer updates this profile first and then the affected policies.

2. Practice profile

3. Locations

Every location below is inside the scope of the risk analysis, the facility walkthrough and the physical safeguards policy.

4. Workforce and PHI access

The detailed minimum-necessary matrix (what each role may open in each system) is in the Uses and Disclosures policy. The named user access list is in the Workforce Security policy.

5. Systems and channels that hold or carry PHI

• EHR / practice management: Open Dental, running as Server in our office.
• Billing and claims: Open Dental eClaims via DentalXChange.
• Email: Microsoft 365. Patient information is sent by email, so the secure-email controls in the Safeguards policy apply.
• Patient communication channels: Phone, Text message (SMS), Email and Mail.
• Fax: in use through Open Dental eFax (BAA signed). The fax procedure in the Safeguards policy applies.
• Paper charts and forms: in use. Paper PHI is stored at Pre-2019 charts in locked cabinets in the records room; current intake forms scanned same day and shredded weekly..
• IT support, backups and security: CRU Technologies (business associate agreement on file).

The complete ePHI inventory, with encryption and backup status for each item, is Section 3 of the Security Risk Analysis Report. The device-level inventory is in the Physical Safeguards policy.

6. Determination

6.1 Is Granite City Family Dental a covered entity?

Yes. Granite City Family Dental, P.A. is a health care provider (Dental) that furnishes care and bills for it. It transmits health information in electronic form in connection with standard transactions (claims, eligibility checks, remittance advice) through Open Dental eClaims via DentalXChange and its EHR, Open Dental. A health care provider that conducts any of these transactions electronically is a covered entity under 45 CFR 160.103. The Privacy Rule (164.500–164.534), the Security Rule (164.302–164.318) and the Breach Notification Rule (164.400–164.414) therefore apply directly to the practice, its owners and its entire workforce.

6.3 Hybrid entity election

The practice does not elect hybrid-entity status under 45 CFR 164.105. All of its operations are health care components, so every part of the practice is covered. If a line of business that does not involve health care is added in the future, the Privacy Officer reviews whether a hybrid designation would be appropriate and documents the decision here.

6.4 Substance use disorder records (42 CFR Part 2)

Granite City Family Dental is not a federally assisted substance use disorder program, so 42 CFR Part 2 does not apply to its records. If the practice begins to hold itself out as providing SUD diagnosis, treatment or referral, the Privacy Officer revisits this determination and the notice.

6.6 State law

The practice treats patients in Minnesota, so the Minnesota Health Records Act (Minn. Stat. 144.291–144.298) applies alongside HIPAA. Minnesota is stricter: most releases of health records, including routine provider-to-provider treatment disclosures outside a related health care entity, require the patient's signed and dated consent (Minn. Stat. 144.293), and the Act is construed more stringently than 45 CFR Part 164 where the two differ (Minn. Stat. 144.2925). Minnesota's breach law (Minn. Stat. 325E.61) also applies when names are exposed with Social Security, driver's license or financial account numbers. The Minnesota supplement in this binder carries the consent policy and form.

6.7 Business associate agreement with the IT provider

A business associate agreement with CRU Technologies is on file and listed in the business associate register.

7. Determination memo

I have reviewed the profile above and confirm that it is accurate as of the date below. On the facts stated, Granite City Family Dental, P.A. is determined to be: Covered entity (health care provider). The practice will comply with the HIPAA Privacy, Security and Breach Notification Rules and the Minnesota Health Records Act as set out in this binder, and will re-examine this determination at every annual review (October) and whenever its operations change.

Owner / principal: Dr. Maria Lindqvist, Owner and Dentist

Signature: ______________________________ Date: ______________

Privacy Officer: Janelle Okafor, Office Manager

Signature: ______________________________ Date: ______________