Make your privacy policy public or face penalties

The federal government has acted to strengthen privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). That means physicians must understand the requirements for the Notice of Privacy Practices (NPP) with patients that have a direct treatment relationship with a patient.

The NPP for your practice must be customized to describe precisely how your office will use the protected health information, and comply with state laws. Be sure you have taken all appropriate steps to obtain patient acknowledgement of your privacy policies. 

First date of service

The practice must provide the NPP to the patient no later than the first service delivery date, including service delivered electronically. 

If treatment is provided under an emergency situation, you must provide the NPP as soon as reasonably feasible after the emergency treatment situation, according to the U.S. Department of Health and Human Services. The physician or practice must make a good-faith effort to obtain a written acknowledgment of receipt of the NPP provided. If the acknowledgment is not obtained, the practice must document its efforts to obtain such acknowledgment and the reason why it was not obtained, except with respect to emergencies. 

Give a comprehensive copy to each patient with the acknowledgment of receipt for ease of patient access. If a summary of the notice is provided, the complete copy should be immediately available. 

Keep a copy handy

A copy of the NPP must be available at the physician’s office for patients who request it.  The patient should not be inconvenienced with asking for the NPP to read for acknowledgment of receipt. 

Post a summary

The NPP must be posted in a clear and prominent location where it is reasonable to expect persons seeking treatment and individuals accompanying them to be able to read it. This applies to changes and updates to the NPP.

The federal Office for Civil Rights has clarified that “providers may post a summary of the notice in such a location as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part. It would not be appropriate, however, to require the individual to have to ask the receptionist for a copy of the full NPP.” 

If the practice maintains a website that provides information about the physician’s customer services or benefits, the NPP and revised copies must be posted on the website and available electronically through the site. 

Email distribution

The NPP may be disseminated via email if the patient agrees to electronic notice and does not withdraw the agreement. If a patient receives the NPP electronically, he or she still has a right to receive a paper copy of the document as frequently as requested. These additional requests should be documented.