HIPAA GENERAL OPERATING POLICY #9
PROVISION OF NOTICE OF PRIVACY PRACTICES FOR PHI
I. General
Except as provided below, an individual has a right to adequate notice of the uses and disclosures of PHI that may be made by a HCC, and of the individual’s rights and the HCC’s legal duties with respect to PHI.
II. Provision of Notice
A HCC must make the notice available on request to any person and to individuals, as follows:
a. Health Plans - A health plan must provide notice:
i. No later than the compliance date for the health plan to individuals then covered by the plan;
ii. Thereafter, at the time of enrollment for new enrollees; and
iii. Within 60 days of a material revision to the notice to individuals then covered by the plan.
iv. No less frequently than once every three years, the health plan must notify individuals then covered by the plan of the availability of the notice and how to obtain the notice.
v. The health plan satisfies the notice requirements of this subsection if notice is provided to the named insured of a policy under which coverage is provided to the named insured and one or more dependents.
vi. If a health plan has more than one notice, it satisfies the requirements of this subsection by providing the notice that is relevant to the individual or other person requesting the notice.
b. Certain Health Care Providers - A covered health care provider that has a direct treatment relationship with an individual must:
i. Provide the notice no later than the date of first service delivery, including service delivered electronically, after the compliance date for the provider or, in the case of emergency treatment, as soon as practicable after the emergency treatment.
ii. Except in emergency treatment situations, make a good faith effort to obtain a written acknowledgment of receipt of the notice, and if not obtained, document its good faith efforts to obtain such acknowledgment and the reason it was not obtained.
iii. If the provider maintains a physical service delivery site, have the notice available at the site for individuals to request and take with them and post the notice in a clear and prominent location for individuals to be able to read.
iv. When the notice is revised, make the notice available upon request on or after the effective date of the revision and promptly comply with subsection (iii) above.
c. Electronic Notice
i. A HCC that maintains a web site that provides information about the provider’s services or benefits must prominently post the notice on the web site and make it electronically available through the web site.
ii. A HCC may provide the notice by e-mail if the individual has agreed to electronic notice and such agreement has not been withdrawn. If the HCC knows the e-mail transmission has failed, it must provide a paper copy.
iii. If the first service delivery is electronic, the provider must provide electronic notice automatically and at the same time as the individual’s first request for service. The requirements regarding obtaining an acknowledgment of receipt of the notice apply to electronic notice.
iv. The individual who receives electronic notice retains the right to obtain a paper copy upon request.
III. Exception for Group Health Plans - An individual in a group health plan has a right to notice:
a. From the group health plan, if, and to the extent that, such an individual does not receive health benefits under the group health plan through an insurance contract with a health insurance issuer or HMO; or
b. From the health insurance issuer or HMO with respect to the group health plan through which such individuals receive their health benefits under the group health plan.
c. A group health plan that provides benefits solely through an insurance contract with a health insurance issuer or HMO, and that creates or receives PHI in addition to summary information, participation information or enrollment information, must maintain a notice and provide such notice upon request to any person. The provisions of paragraph II(a) above do not apply to such health plans.
d. A group health plan that provides benefits solely through an insurance contract with a health insurance issuer or HMO, and that does not create or receive PHI other than summary information, participation information or enrollment information, is not required to maintain or provide a notice under this section.
IV. Revisions
The HCC must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the individual’s rights, the HCC’s legal duties, or other privacy practices in the notice. Except when required by law, a material change may not be implemented prior to the effective date in the notice in which such change is reflected.
V. Documentation
A HCC must document compliance with the notice requirements by retaining copies of the notices issued by the HCC and, if applicable, any written acknowledgments of receipt of the notice or documentation of good faith efforts to obtain such written acknowledgment.