Because of the changes brought about through the HIPAA Omnibus Rule, there has been much confusion with regard to the Notice of Privacy Practices, how to make it available to your patients and how to post it at your practice. You may access the new NPP for Omnibus on our website. The distribution of your new NPP remains the same.
The Privacy Rule provides individuals, with certain limited exceptions, with a right to receive a
NPP, which, among other things, describes how a covered entity may use and disclose their PHI, the individuals' rights with respect to that information, as well as the covered entity's obligations to protect the information.
The Privacy Rule generally requires that covered healthcare providers with direct treatment relationships with individuals provide a copy of the NPP directly to the individual on the date the first service is provided, and make a good faith effort to obtain the individual's written acknowledgment of receipt of the NPP. In addition, the provider must post its NPP at its facility or office and have it available for any person who requests a copy. The Privacy Rule requires that a covered entity's NPP be written in plain language. See 45 C.F.R. 164.520.
The Privacy Rule also contains several NPP provisions that are relevant to covered entities that operate in an electronic environment. First, the Privacy Rule requires a covered entity that maintains a web site providing information about the covered entity's services or benefits to prominently post its NPP on its web site. Further, where a health care provider delivers its first health care service to an individual electronically, such as through e-mail, or over the Internet, the provider must send an electronic NPP automatically and contemporaneously in response to the individual's request for service. Also, in general, a covered entity is permitted to e-mail its
NPP to an individual if the individual agrees to receive an electronic NPP (although the individual always retains the right to receive a paper copy of the NPP upon request). See 45 C.F.R. 164.520(c)(3).