HIPAA's Notice of Privacy Practices - It's the 3 Year Anniversary for Most of Us
I've gotten several inquiries lately about what some perceive to be a "new" HIPAA notice which was to be distributed to plan participants as of April 14th of this year. Everyone take a deep breath. All we are talking about here is the requirement that all plan participants must be notified at least once every three years with the privacy notice or with information on how to obtain the notice. Assuming you already did this three years ago (or two years ago for smaller plans), it's just time to reissue the notice (or next year for those smaller plans).
Generally, the HIPAA Privacy Notice gives plan participants information about how the plan will deal with protected health information.
Here's the general rule:
Covered entities are required to provide a notice in plain language that describes:
1. How the covered entity may use and disclose protected health information about an individual.
2. The individual's rights with respect to the information and how the individual may exercise these rights, including how the individual may complain to the covered entity.
3. The covered entity's legal duties with respect to the information, including a statement that the covered entity is required by law to maintain the privacy of protected health information.
4. Whom individuals can contact for further information about the covered entity's privacy policies.
5. The notice must include an effective date.
Providing the Notice:
1. A covered entity must make its notice available to any person who asks for it.
2. A covered entity must prominently post and make available its notice on any website it maintains that provides information about its customer services or benefits.
3. Health Plans must also:
- Provide the notice to individuals then covered by the plan no later than April 14, 2003 (April 14, 2004, for small health plans) and to new enrollees at the time of enrollment.
- Provide a revised notice to individuals then covered by the plan within 60 days of a material revision.
- Notify individuals then covered by the plan of the availability of and how to obtain the notice at least once every three years.
A covered entity may e-mail the notice to an individual if the individual agrees to receive an electronic notice.
So, how should remind ourselves to do this every three years? Why not just send out these materials with open enrollment materials every year? For more information, you can access this publication on the Department of Health and Human Services Website. For their HIPAA page, go here.