Notice of Privacy Practices
noindex.
It cannot publish until counsel review is confirmed by ACHS. Every page needs a named approver before it goes live — DCH General Services §605.1.28 makes
each published version a retained advertising record.
A Notice of Privacy Practices is the HIPAA document telling patients how a health care provider uses and discloses their protected health information, and what rights they have over it. It is a different document from a website privacy policy. This notice is in preparation and not yet in effect.
Status
This document has not been drafted, has not been reviewed by counsel, and is not in effect. Nothing on this page is an operative notice or a statement of current agency practice.
What this document must cover
The Notice of Privacy Practices is a regulated document under the HIPAA Privacy Rule at 45 CFR 164.520, which prescribes its required content, its wording in places, and how it must be provided. It is not marketing copy and it is not a template exercise.
The drafted notice must contain, at minimum:
- The required header, in the form the regulation specifies, stating that the notice describes how medical information about the individual may be used and disclosed and how they can get access to it.
- Uses and disclosures for treatment, payment and health care operations, each described with a concrete example relevant to case management work.
- Other permitted or required disclosures, including those required by law, public health activities, health oversight, judicial proceedings, and abuse or neglect reporting.
- Uses requiring written authorization, expressly including most uses of psychotherapy notes, marketing, and any sale of protected health information, together with the right to revoke an authorization.
- Individual rights, each with how to exercise it: access and copies, amendment, an accounting of disclosures, restriction requests, confidential communications, a paper copy on request, and notification following a breach.
- The covered entity’s duties, including the duty to maintain the privacy of protected health information and to abide by the terms of the notice currently in effect.
- Complaints: how to complain to the agency and how to complain to the Secretary of HHS, and a statement that no retaliation will follow.
- A contact point and an effective date, plus how revisions will be communicated.
Placement and delivery must be settled at the same time as the text: posted on this site, provided to members at the start of the relationship with acknowledgment recorded, available in paper on request, and accompanied by the Section 1557 notice of availability.
Questions people ask about this
Is a Notice of Privacy Practices the same as a website privacy policy?
No, and the two are frequently confused. A Notice of Privacy Practices is a HIPAA document about protected health information held by a covered entity. A website privacy policy is about what a website collects from visitors. An organization subject to HIPAA needs both, and one cannot stand in for the other.
Who has to be given this notice?
A covered entity must make the notice available to individuals whose protected health information it holds, provide it at the point the relationship starts, make it available on request, and post it prominently on any website it maintains that describes its services.
What rights does the notice describe?
Rights individuals hold over their own health information under HIPAA, including access to their records, the ability to request amendments, an accounting of certain disclosures, the ability to request restrictions and confidential communications, and the right to complain without retaliation.
Related questions
- Website privacy policy How this website handles visitor data, analytics, cookies and information submitted through forms. This document is in preparation and is not yet in effect.
- Language assistance notice The Section 1557 notice of free language assistance and auxiliary aids and services. This document is in preparation and is not yet in effect.