Notice of privacy practices

Q: What are my obligations under HIPAA when it comes to distributing our office's notice of privacy practices?

A: HIPAA requires that patients receive a copy of your notice of privacy practices (or NPP), whether it's delivered by hand, by mail, or electronically. Get the patient's signature acknowledging that she saw the notice. If, for some reason, you can't get someone's signature, indicate in that patient's record that you gave her a copy of your NPP and made a good faith effort to get her signature. Then document the reasons why it proved unsuccessful. Office-based physicians are also required to post their NPP in a prominent location.

You don't have to redistribute your NPP to established patients unless you change your privacy practices. If you do, amend your notice to reflect the changes, and provide an updated copy to all patients. (An acknowledgement of receipt of the updated notice isn't required.)

If, in looking over your records, you find nothing to indicate that an established patient ever received your notice of privacy practices, give that patient the notice and try to obtain the patient's written acknowledgment. A word of caution: If you continue to treat a patient who hasn't received an NPP, that patient has the right to file a complaint against you with the Office for Civil Rights, US Department of Health and Human Services.