PROVIDING NOTICE OF PRIVACY PRACTICES
THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996
A covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is generally required to give notice of its privacy practices relative to an individual's protected health information. The contents of the notice are described in a separate article. This article addresses the individuals or persons to whom the notice must be made available.
A covered entity must make the notice available to any person upon request, including members of the general public. This includes persons who are not currently patients or enrollees in a health care plan. The intention is to make the notice available so that privacy practices can be easily compared, allowing a person to select a health plan or health care provider accordingly.
The covered entity must make the notice available upon request to individuals who are identified in certain circumstances described below. The Department of Health and Human Services (HHS) has not mandated the form of the notice that is to be provided. HHS permits a notice to be distributed in a newsletter of other communications with individuals, but the notice must be sufficiently separate from other important documents such as a consent or authorization form.
Health Plans
Health plans have to provide notice to individuals who were covered by the plan at the time the health plan was required to comply with HIPAA (for most health plans, the compliance date has passed). For new enrollees in the health plan after the compliance date, the health plan must provide the notice at the time of enrollment. If the notice is materially revised, the health plan has 60 days to provide the revised notice to all individuals covered by the plan. Thereafter, the health plan must remind all individuals covered by the plan of the availability of the notice at least once every three years. The individuals must also be advised as to how they can obtain a copy of the notice. If health care coverage is provided under an insurance policy, notice is satisfied if it is received by the named insured even if he or she has one or more dependents. If the health plan has more than one notice, only the notice relevant to the individual or person requesting the notice need be provided.
Notice for Certain Covered Health Care Providers
A covered health care provider that has a direct treatment relationship with an individual must provide the notice to the individual no later than first service delivery date, including service delivered electronically, after the HIPAA compliance date for the covered health care provider (the compliance date has generally passed for most covered health care providers). A covered health care provider can comply with the notice distribution requirement if it provides the notice to the parent of a minor child who is obtaining treatment. A health care provider who first provides treatment to an individual over the telephone satisfies the notice requirement if it mails the notice to the individual on the day that first treatment is delivered. Where initial contact with a patient is merely to schedule an appointment, for example, notice and acknowledgment requirements can be satisfied when the patient arrives for the appointment.
The covered health care provider must make a good faith effort to get a written acknowledgement from the individual that evidences his or her receipt of the notice. The Privacy Rule does not require that the individual's signature be on the notice. As an example, HHS explains that the individual may simply initial a cover sheet of the notice that will be retained by the health care provider. A pharmacist is allowed to have an individual sign or initial an acknowledgement in a log book when he or she picks up a prescription as long as the acknowledgement is clearly explained and not used as a waiver or permission for something else (such as a waiver to consult with the pharmacist). If a notice is first provided electronically, the health care provider's system can be configured to capture the individual's acknowledgment electronically. HHS explains that the notice acknowledgement process is flexible but that written acknowledgment is required because it focuses the individual's attention on the notice.
If written acknowledgement is not obtained, the health care provider must document its good faith efforts to obtain the acknowledgement and explain why it could not obtain the acknowledgement. As long as this is documented, the covered health care provider does not violate HIPAA's Privacy Rule if it uses or discloses protected health information.
A covered health care provider is allowed to send notice in advance of the date service is first delivered. For example, a doctor may send the notice to a new patient before the first visit to free up time or office staff at the doctor's office. Upon giving the individual a copy of the notice on the first visit, the covered health care provider is under no further obligation to distribute the notice.
Covered health care provides that have an indirect treatment relationship with individuals, e.g., clinical laboratories, only have to provide the notice upon request.
If direct treatment is being provided in an emergency situation, a covered health care provider must provide the notice as soon as reasonably practicable after the emergency treatment situation abates. HHS received comments to its proposed Privacy Rule from ambulance providers who were concerned that an "emergency situation" was not sufficiently defined to encompass non-emergency situations where ambulances were deployed, such as when elderly persons were being transferred by an ambulance in non-emergency situations. The ambulance providers noted that elderly persons often suffer from incapacity or stressful conditions when they need to be transferred by ambulance but that it may not be effective to provide the notice and obtain the elderly person's acknowledgement at that time. In response, HHS stated that the emergency provision was intended to provide an exception in a situation where providing the notice and obtaining acknowledgment would not be practicable or feasible. When an extenuating circumstance does not exist, HHS expects covered health care providers to provide the notice and make a good faith effort to obtain the acknowledgement. If they are not able to obtain the acknowledgment, covered health care providers are only required to document their good faith effort to obtain the acknowledgment.
If a direct treatment health care provider revises its notice of privacy practices, the provider must make the notice available upon request on or after the effective date of the revision. Thus, a new written acknowledgement is not required when the notice is revised.
Covered Health Care Providers that Maintain a Physical Delivery Site
A covered health care provider that maintains a physical delivery site must, in addition to the above requirement, post the notice (including any revisions) in a visible and prominent location where it is reasonable to expect that the notice will be seen. The provider must also make copies of the notice available to individuals who request the notice and want to take a copy of the notice with them.
Requirements for Electronic Notices
A covered entity that has a website containing information about its customer services or benefits must prominently post its notice on the website and make it available through the website.
A covered entity is permitted to provide the notice to an individual by e-mail if the individual has agreed to electronic notice (and that agreement has not been revoked). Where the e-mail returns as undeliverable, the covered entity has to provide the individual with a paper notice. The timing of the notice is as described above. In the event that service is first delivered electronically, electronic notice has to accompany the delivery.
Written acknowledgement of receipt of the notice is still required. As previously mentioned, if the notice is provided electronically, the system will typically allow for the individual's acknowledgment to be captured electronically. If the individual refuses to give his or her acknowledgment, the covered entity must document the refusal as described above.
An individual always maintains the right to receive a paper copy of the notice upon request, even if he or she has agreed to electronic notice.
Copyright 2008 LexisNexis, a division of Reed Elsevier Inc.
