Model Notices of Privacy Practices

The HIPAA Privacy Rule gives individuals the right to be informed about the privacy practices of their health plans and most healthcare providers, as well as their rights concerning personal health information. Health plans and covered healthcare providers must develop and distribute a clear notice explaining these practices and rights. The notice is intended to help individuals understand privacy matters, discuss them with their plans and providers, and exercise their rights.

General rule

An individual has a right to adequate notice of how a covered entity may use and disclose protected health information, the individual's rights, and the covered entity's obligations regarding that information. Most covered entities must develop and provide this notice.

The Privacy Rule does not require the following covered entities to develop a notice:

• A healthcare clearinghouse whose only protected health information is created or received as a business associate of another covered entity.
• A correctional institution that is a covered entity.
• A group health plan that provides benefits only through insurance or HMO contracts and receives no protected health information other than summary, enrollment, or disenrollment information.

See 45 CFR 164.500(b)(1) and 45 CFR 164.520(a).

A covered entity's notice must use plain language and describe:

• How the covered entity may use and disclose an individual's protected health information.
• The individual's rights and how to exercise them, including how to complain to the covered entity.
• The covered entity's legal duties, including its duty to maintain the privacy of protected health information.
• Whom to contact for more information about its privacy policies.
• The notice's effective date.

See 45 CFR 164.520(b). A covered entity must promptly revise and distribute its notice after materially changing its privacy practices.

• A covered entity must make its notice available to anyone who asks for it.
• A covered entity must prominently post and make the notice available on any website it maintains that describes customer services or benefits.

Health plans

Health plans must also:

• Provide the notice to new enrollees at enrollment.
• Provide a revised notice after a material revision as required by law.
• Periodically notify covered individuals that the notice is available and explain how to obtain it.

Covered direct-treatment providers

Covered direct-treatment providers must also:

• Provide the notice no later than the first service delivery and, except in an emergency, make a good-faith effort to obtain written acknowledgment of receipt. If acknowledgment cannot be obtained, document the effort and the reason.
• When first service is delivered electronically, send the notice automatically and at the same time as the individual's first request for service, and make a good-faith effort to obtain a return receipt or other response.
• After an emergency treatment situation ends, provide the notice as soon as reasonably practical.
• Make the current notice available at the provider's office or facility and post it in a clear, prominent location.

A covered entity may email the notice when the individual agrees to receive it electronically. See 45 CFR 164.520(c).

A covered entity, including a hybrid or affiliated covered entity, may develop more than one notice when it performs different covered functions and its privacy practices vary among them. Covered entities are encouraged to give individuals the most specific notice possible.

Covered entities participating in an organized healthcare arrangement may use one joint notice when legal requirements are met. The joint notice must describe the covered entities and service locations to which it applies. If one participating entity provides the joint notice, the distribution requirement is satisfied for the other participating entities. See 45 CFR 164.520(d).