Healthcare Providers Must Get Compliant with HIPAA Privacy Practices

Steven M. Harris, Esq.

In my April 2013 article, “Department of Health and Human Services’ Final Rule Expands HIPAA Obligations, Violation Penalties,” I noted that as part of the recent changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), healthcare providers are required to update their “Notices of Privacy Practices.”

If you are a healthcare provider (e.g., medical practice, physician, hospital) and either do not have a Notice of Privacy Practices or have not updated your Notice of Privacy Practices in 2013, now is the time to get compliant. Failure to have an updated Notice of Privacy Practices by September 23, 2013 is a violation of HIPAA and could result in fines and penalties.

Background

In January 2013, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) issued an omnibus final rule (Final Rule) implementing various provisions of the Health Information Technology for Economic and Clinical Health Act (HITECH Act). The Final Rule revises HIPAA, and included in that rule are requirements affecting Notices of Privacy Practices.

What is a “Notice of Privacy Practices”?

A Notice of Privacy Practices is a written notice that healthcare providers are required under HIPAA and the HITECH Act to provide to patients that explains the patients’ rights as they relate to their health information and the privacy practices of the healthcare provider. Notices of Privacy Practices are intended to inform patients of their privacy rights, and to encourage patients to have discussions with their healthcare providers about these rights.

What Must Be Included in Notices of Privacy Practices?

Healthcare providers are required to provide patients with a Notice of Privacy Practices that is written in plain language and includes a number of elements.

First, Notices of Privacy Practices must describe how the healthcare provider can use and disclose a patient’s protected health information. A new change imposed by the Final Rule mandates that Notices of Privacy Practices include a description of certain types of uses and disclosures of protected health information that require an authorization. Now, Notices of Privacy Practices must explicitly state that if a healthcare provider will use or disclose a patient’s healthcare information for marketing purposes or in a sales transaction (receipt of remuneration in exchange for patient health information), or if such health information includes psychotherapy notes, then the healthcare provider must first obtain an authorization. Further, the authorization must explicitly acknowledge that remuneration is involved.