1. Privacy Notice - Requirements
Must be written in plain language and contain required elements
Header statement
“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”
June 2014
HIPAA - Privacy Practices Notice

2. Privacy Notice - Requirements
Description (incl. at least 1 example) of the types of uses/disclosures for each of the following purposes: treatment/payment/health care operations
Description of other purposes permitted or required without the individual’s written authorization
Statement that other uses/disclosures will made only with written authorization and that this authorization may be revoked
June 2014
HIPAA - Privacy Practices Notice

3. Privacy Notice - Requirements
Separate statement for certain uses/disclosures:
HCP may contact the individual to provide appointment reminders or info about alternative tx or other health-related benefits that may be of interest
June 2014
HIPAA - Privacy Practices Notice

4. Privacy Notice - Requirements
Statement of Individual Rights
Right to request restrictions on certain uses/disclosures of PHI (ensure it is clear you are NOT required to agree to the request)
Right to receive confidential communications of PHI
Right to inspect and copy PHI
Right to amend PHI
Right to receive an accounting of disclosures of PHI
Right to receive a paper copy of this Notice upon request (you may it but if not received you must be ready to provide a paper copy)
June 2014
HIPAA - Privacy Practices Notice

5. Privacy Notice - Requirements
Statement that you are required by law to “maintain the privacy of PHI and to provide individuals with notice of your legal duties and privacy practices with respect to PHI”
Statement that you are required to abide by the terms of the notice currently in effect
Statement that you reserve the right to change the terms of your notice and to make the changes effective for all PHI you maintain (include statement on how you will provide a revised notice to the individual)
June 2014
HIPAA - Privacy Practices Notice

6. Privacy Notice – Requirements
Statement that individuals may file a complaint to the HCP and the Secretary of HHS if they believe their “privacy rights have been violated”
Brief description of how to file the complaint with the HCP
Statement of no retaliation for filing a complaint
June 2014
HIPAA - Privacy Practices Notice

7. Privacy Notice - Requirements
Contact Info
Name
Title
Telephone #
Effective Date
Date on which the notice is first in effect
May not be earlier than date of print / publish
June 2014
HIPAA - Privacy Practices Notice

8. Privacy Notice – Providing to the Individual
No later than first service delivery
Personal visit: in person
Telephone: mailing
Electronic: electronic means
Emergencies – as soon as reasonable
Offices:
Hard copies available
Posted in a “clear and prominent location where it is reasonable to expect individuals seeking services to be able to read the notice”
Web sites:
Any site providing info about services or benefits
Copy must be available electronically via the site
Revised notice:
Copies must be available upon effective date of change
June 2014
HIPAA - Privacy Practices Notice

9. Is a Patient Acknowledgement needed?
HCP must make a “good faith effort” to obtain written acknowledgement of receipt of the Notice
Content is not specified
If unable to obtain acknowledgement, HCP must document the reason why
HCP is relieved of need to request in an emergency
June 2014
HIPAA - Privacy Practices Notice

10. Privacy Notice – Documentation
HCP must make a “good faith effort” to obtain a written acknowledgment of the receipt of the notice
If not obtained, document your “good faith efforts” and reason why it was not obtained
Be sure to retain copies of any notices you issue
June 2014
HIPAA - Privacy Practices Notice