September 23, 2013 is the fast-approaching compliance deadline for the final omnibus HIPAA/HITECH rules. Many provisions required revisions to Notices of Privacy Practices (NPPs) maintained and distributed by covered entities. The U.S. Department of Health and Human Services (HHS) has made clear that these changes are material. As a result, covered entities must redistribute their NPPs shortly in order to meet HITECH’s requirements. This alert describes the manner of redistribution dictated by HIPAA.
General Requirements
When revising NPPs, keep in mind that whether paper or web-based, HHS requires them to be accessible to all individuals, including those with disabilities. Covered providers required to comply with Section 504 of the Rehabilitation Act or the Americans with Disabilities Act must also take steps to ensure effective communication with individuals with disabilities, including making the revised NPP available in Braille, large print, or audio. HIPAA also requires NPPs to be written in plain language.
Changes to the NPP may not be implemented prior to the NPP’s new effective date, unless otherwise required by law. Typically, any change to the practices described within the revised NPP may only be applied to PHI created or received after the effective date of the change. All previous versions of the NPP and any acknowledgments of its receipt must be maintained for six years from the last effective date.
If You Are a Health Care Provider
For existing patients, you must make the revised NPP available upon request on or after the effective date of the changes (for most, this date will be September 23, 2013). If you have a physical service delivery site (such as a clinic or hospital), you must have copies of the NPP available at the site for individuals to take with them upon request. You also must post a copy of the NPP or summary of the revisions in a clear and prominent location, where it is reasonable to expect individuals to be able to read the posting. You must ensure all new patients receive the revised NPP at the time of first service after the effective date of the changes. The revised NPP must be made available on your website if you have one. If patients have agreed to receive electronic notice of the NPP, you may e-mail the revised NPP to those patients. You do not need to obtain acknowledgment of receipt from individuals, except for the initial distribution of the NPP provided at the first time of service.
If You Are a Health Plan
You must distribute the revised NPP to current plan participants. If you post your NPP on a website, then you must post the revised NPP, or a description of the material changes, prominently on that website by the effective date of the changes. You also must provide in your next annual mailing to participants either the revised NPP or information regarding material changes and how to obtain a copy of the NPP. If you do not post your NPP on a website, then you must provide participants with the revised NPP or information about the material changes and how to obtain the revised NPP within 60 days of the material changes. Note that all health plans also must continue to notify participants of the availability of the NPP and how to obtain a copy at least once every three years.
HHS has stated that if covered entities or health plans amended and redistributed NPPs prior to issuance of the final omnibus rule then they are not required to repeat the process, so long as the current NPP that was redistributed meets all the requirements in the final rule. For all other covered entities, the NPP must be revised and effective by September 23, 2013, and redistributed as appropriate.
