Notice of Privacy Practices
There are several requirements pertaining to a covered entity’s Notice of Privacy Practices. There are requirements for specific content, for posting the Notice, for providing copies to patients, and obtaining an acknowledgment of receipt.
Assuming your practice has developed or obtained a compliant Notice for use, this article will help ensure it is posted and available to patients as required.
If your practice uses our HIPAA Compliance System, a compliant Notice is included and updated as necessary. The content requirements that are adhered to are explained in section 3.11 of the HIPAA Policy Manual.
Posting the Notice
A current copy of the Notice must be posted in a conspicuous area of the practice, such as in the patient check-in or waiting area. If the practice maintains a website that provides information about its customer services, a copy of the Notice must be posted prominently and available to print. An example of prominent posting would include a direct link from the home page with a clear description that the link is to the HIPAA Notice of Privacy Practices.
Provision of the Notice
A copy of the Notice must be provided to each individual upon the first delivery of service (including service delivered electronically), and as soon as practicable after an emergency treatment situation. A copy of the Notice must also be provided whenever requested by an existing or prospective patient.
If your practice revises your Notice, it is not necessary to distribute the revised version to existing patients that had received a copy of the original version. The new Notice must only be provided to existing patients upon request. As a courtesy, you may let patients know with a sign or communication from front desk staff that your Notice has changed, and that copies of the Notice are available upon request.
When the Notice is provided upon first service, the practice is required to make a good faith effort to obtain an acknowledgement from the patient that a copy of the Notice was received. You may simply record a note in the patient’s record if you are unable to obtain an acknowledgement for some reason. The practice is not required to obtain an acknowledgement of receipt if further copies of the Notice are requested.
Acknowledgement of Receipt
We are often asked whether a patient’s acknowledgement of receipt (of the Notice) can be combined with an authorization form. Unfortunately, the answer is no. Authorization forms may not be combined with any other form and must contain a number of required elements.
The good news is that you may combine a patient acknowledgement with your standard new patient form—one that asks the patient to fill in his/her demographic/contact information.
A sample acknowledgement appears below, and as mentioned, may be added to an existing new patient form. The Privacy Rule does not specify the form of written acknowledgment, so if you’ve been using a different type, such as having patients provide their initials, that is perfectly fine.
Maintaining Earlier Versions
Outdated versions of the Notice must be maintained for a minimum of six years from the date they are superseded by a newer version.
