April 20, 2014

Countdown to HITECH Compliance: How to Redistribute Your Notice of Privacy Practices

​September 23, 2013 is the fast-approaching compliance deadline for the final omnibus HIPAA/HITECH rules.  Many provisions required revisions to Notices of Privacy Practices (NPPs) maintained and distributed by covered entities.  The U.S. Department of Health and Human Services (HHS) has made clear that these changes are material.  As a result, covered entities must redistribute their NPPs shortly in order to meet HITECH’s requirements.  This alert describes the manner of redistribution dictated by HIPAA. 

General Requirements 

When revising NPPs, keep in mind that whether paper or web-based, HHS requires them to be accessible to all individuals, including those with disabilities.  Covered providers required to comply with Section 504 of the Rehabilitation Act or the Americans with Disabilities Act must also take steps to ensure effective communication with individuals with disabilities, including making the revised NPP available in Braille, large print, or audio.  HIPAA also requires NPPs to be written in plain language.

Changes to the NPP may not be implemented prior to the NPP’s new effective date, unless otherwise required by law.  Typically, any change to the practices described within the revised NPP may only be applied to PHI created or received after the effective date of the change.  All previous versions of the NPP and any acknowledgments of its receipt must be maintained for six years from the last effective date.

If You Are a Health Care Provider

For existing patients, you must make the revised NPP available upon request on or after the effective date of the changes (for most, this date will be September 23, 2013).  If you have a physical service delivery site (such as a clinic or hospital), you must have copies of the NPP available at the site for individuals to take with them upon request.  You also must post a copy of the NPP or summary of the revisions in a clear and prominent location, where it is reasonable to expect individuals to be able to read the posting.  You must ensure all new patients receive the revised NPP at the time of first service after the effective date of the changes.  The revised NPP must be made available on your website if you have one.  If patients have agreed to receive electronic notice of the NPP, you may e-mail the revised NPP to those patients.  You do not need to obtain acknowledgment of receipt from individuals, except for the initial distribution of the NPP provided at the first time of service. 

If You Are a Health Plan

You must distribute the revised NPP to current plan participants.  If you post your NPP on a website, then you must post the revised NPP, or a description of the material changes, prominently on that website by the effective date of the changes.  You also must provide in your next annual mailing to participants either the revised NPP or information regarding material changes and how to obtain a copy of the NPP.  If you do not post your NPP on a website, then you must provide participants with the revised NPP or information about the material changes and how to obtain the revised NPP within 60 days of the material changes.  Note that all health plans also must continue to notify participants of the availability of the NPP and how to obtain a copy at least once every three years.

HHS has stated that if covered entities or health plans amended and redistributed NPPs prior to issuance of the final omnibus rule then they are not required to repeat the process, so long as the current NPP that was redistributed meets all the requirements in the final rule.  For all other covered entities, the NPP must be revised and effective by September 23, 2013, and redistributed as appropriate.

© 2014 Poyner Spruill LLP. All rights reserved.

About the Author

Tara N. Cho, Poyner Spruill Law Firm, Privacy Attorney

Tara’s practice focuses on privacy and information security.  She advises on privacy issuesand identification of potential risks and the development of associated policies and procedures to maintain compliance.  She is also experienced with privacy compliance auditing, regulatory requirements in clinical research, European data protection requirements and Safe Harbor certifications, data transfer agreements and contract negotiation.


About the Author

Elizabeth Johnson, Privacy, Information Security Attorney, Poyner Spruill, law

Elizabeth’s practice focuses on privacy, information security, and records management. Her comprehensive, practical approach to privacy law is reflected by the diversity of her clients, which hail from a variety of industries including health care, financial services, insurance, retail, telecom, utility, technology, consumer goods and client services. Elizabeth has also worked with organizations of various size and scope, ranging from Fortune 100 companies with international reach to local charities.  She was listed among the top privacy professionals in Computerworld’s...


Boost: AJAX core statistics

Legal Disclaimer

You are responsible for reading, understanding and agreeing to the National Law Review's (NLR’s) and the National Law Forum LLC's  Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.  

Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is  intended to be  a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional.  NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us. 

Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.

The National Law Review - National Law Forum LLC 4700 Gilbert Ave. Suite 47 #230 Western Springs, IL 60558  Telephone  (708) 357-3317 If you would ike to contact us via email please click here.