The United States Department of Health and Human Services (HHS) provides a helpful set of questions and answers on its website regarding the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Professionals should note that this guidance is informal, may be updated or withdrawn, and may differ from state laws. Below, we highlight three questions and answers from the HHS website.
Does the HIPAA Privacy Rule permit health care providers to obtain an electronic acknowledgement of the notice [of privacy practices] from individuals?
For notice delivered electronically, an electronic return receipt or other return transmission from the individual is considered a valid written acknowledgment of the notice. A provider who gives his paper notice to a patient during a face-to-face encounter with the individual at first service delivery may also obtain an electronic acknowledgment from the individual, provided that the individual's acknowledgment is in writing. Thus, a receptionist's notation in the provider's computer system of the individual's receipt of the notice would not be considered a valid written acknowledgment of the individual.
Created 12.20.02
Content reviewed last July 26, 2013
Are health care providers required by the HIPAA Privacy Rule to post their entire notice at their facility or may they post just a brief description of the notice?
Covered health care providers that maintain an office or other physical site where they provide health care directly to individuals are required to post their entire notice at the facility in a clear and prominent location. The Privacy Rule, however, does not prescribe any specific format for the posted notice, just that it includes the same information that is distributed directly to the individual. Covered health care providers have discretion to design the posted notice in a manner that works best for their facility, which may be to simply post a copy of the pages of the notice that is provided directly to individuals.
Created 12.20.02
Content reviewed last January 9, 2023
Are hospitals or other health care providers required to provide their notices to patients they treat in an emergency?
Hospitals and other covered health care providers with a direct treatment relationship with individuals are not required to provide their notices to patients at the time they are providing emergency treatment. In these situations, the HIPAA Privacy Rule requires only that providers give patients a notice when it is practical to do so after the emergency situation has ended. In addition, where notice is delayed by an emergency treatment situation, the Privacy Rule does not require that providers make a good-faith effort to obtain the patient's written acknowledgment of receipt of the notice.
Created 12.20.02
Content reviewed last July 26, 2013
Individuals have a right to receive adequate notice of a covered entity's uses and disclosures of their protected health information (PHI), known as a Notice of Privacy Practices (NPP). The HIPAA Privacy Rule outlines what must be included in the notice, including statements setting forth the patient's rights (i.e., right to request an amendment, right to request restrictions on certain uses and disclosures of PHI). For a full list of requirements, see 45 CFR § 164.520(b). HHS provides model notice templates that may be tailored to a specific covered entity. These model templates were revised earlier this year to reflect the new requirements for HIPAA covered entities regarding the privacy of substance use disorder (SUD) patient records, accounting for the limited circumstances where a covered entity may use or disclose information in a SUD patient record (i.e., with the patient's consent or a valid court order and a subpoena). Covered entities must provide their NPP to all patients upon request and display the NPP in a clear and prominent location. Additionally, there are specific requirements depending on the covered entity type. For example, a covered health care provider that has a direct treatment relationship with an individual must provide the NPP no later than the first service delivery date and make a good-faith effort to obtain the individual's written acknowledgement of receipt of the NPP. In the event of an emergency, the NPP should be provided as soon as reasonably practicable following the emergency.
For more information, please contact Grant Dearborn, Kate Crawford, or another member of Shumaker’s Health Law Service Line.