Notice of Privacy Practices

The HIPAA Privacy Rule requires a health plan to remind enrollees of the availability of its Notice of Privacy Practices, as well as how to obtain a copy, no less frequently than once every 3 years. (45 CFR 164.520(c)(1)(ii))

Health plans, other than small health plans (i.e., plans with annual receipts of $5 million or less), were required to distribute their Notice of Privacy Practices to participants by April 14, 2003.

For small health plans, which had until April 14, 2004, to first distribute their Notices of Privacy Practices, the compliance date for their first triennial reminder notice requirement would have been April 14, 2007. As a practical matter, however, experts suggest that companies that are subject to this requirement, provide the notice annually, along with other required materials, at the time of enrollment. This would remove the burden of the confusing three-year-rule, and at the same time ensure that all covered participants, including new employees, have been notified.

Moreover, the Privacy Rule does not require a group health plan that provides benefits only through one or more contracts of insurance with health insurance issuers or HMOs, and that does not create or receive protected health information other than summary health information or enrollment or disenrollment information to develop a notice. Thus, group health plans that are fully insured and receive only enrollment and summary health information are generally not required to maintain or distribute a Notice of Privacy Practices. (45 CFR 164.520(a))

Plans that are required to send the reminder, may satisfy this obligation by sending a copy of their Notice of Privacy Practices; by mailing only a reminder concerning the availability of the Notice of Privacy Practices and information on how to obtain a copy; or by including in a plan-produced newsletter or other publication information about the availability of the Notice of Privacy Practices and how to obtain a copy. The notice or reminder must be distributed in paper format unless the participant previously agreed to accept an electronic transmission of this information.

A group health plan is not obligated to deliver the reminder notice to every person covered by the plan. Instead, a plan can satisfy the requirement by providing the reminder notice to the named insured.