iToday the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC) released model Notices of Privacy Practices (Notices). The model Notices were released in three different customizable styles developed by OCR and ONC for health care providers and health plans to use to communicate with patients and plan members.
Notices are required under the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA) Privacy Rule, which gives individuals the right to be informed of their privacy rights and the privacy practices of their health plans and most of their health care providers. Every health plan and covered entity health care provider is required to develop and distribute a Notice that provides a clear explanation of these rights and practices.
Under the Omnibus Final Rule, which was released earlier this year, all HIPAA covered entities are required to update and make available their updated Notices. The Omnibus Rule requires Notice updates based on new requirements, including:
-
Uses and disclosures of health information that require authorization, including marketing, sale of protected health information, and disclosure of psychotherapy notes;
-
Specific statements regarding certain activities, including certain treatment and fundraising communications and individuals’ right to opt out of such communications;
-
Enhanced patient rights, including individuals’ right to restrict disclosures of health information to a health plan where individuals pay for a service in full out-of-pocket;
-
New breach notification requirements; and
-
New prohibitions on the use of genetic information for underwriting purposes (health plans only).
A health plan or health care provider that uses the model Notices should customize the appropriate model form, so that it accurately reflects the covered entity’s privacy practices.
Health care providers must post revised Notices in a prominent location and make Notices available to an individual upon request. Health plans that currently post Notices on outward facing websites must post updated Notices by September 23, 2013 and provide the revised Notice (or information about material changes) in the plan’s next annual mailing. Health plans that do not have customer service websites must provide the revised Notice (or information about material changes) within 60 days of making revisions to the Notice.
Additional information regarding Omnibus Rule requirements is available here.
