HIPAA PRIVACY RULE
Privacy Practices
Health Insurance Portability and Accountability Act

NOTICE OF PRIVACY PRACTICES FOR PROTECTED HEALTH INFORMATION
(Full Text Version)

The model Notice of Privacy Practices developed by the Medical Society of the State of New York is intended as a general reference to assist a medical practice to develop its own practice specific notice. 

Strong caution is provided that the model should not be merely copied without careful review and consideration by the medical practice. The policies and procedures of each medical practice vary and the Medical Society of the State of New York cannot develop a model that is pertinent or relevant to every medical practice. There may be descriptions of policies and practices contained in the model that are not relevant to or are inconsistent with the policies and practices of your medical practice. Your medical practice may follow policies and practices that are not reflected in the model.

The model Notice of Privacy Practices is intended as a general reference source only and does not constitute legal advice and does not establish an attorney client relationship.

A health care provider that has a direct treatment relationship with an individual must provide the Notice of Privacy Practices no later than the first service delivery, including service delivered electronically, to the individual after the April 14, 2003 compliance date.

A direct treatment relationship means a treatment relationship that is not an indirect treatment relationship. An indirect treatment relationship means a treatment relationship between an individual and a health care provider in which: (1) the health care provider delivers health care to the individual based on the orders of another health care provider; and (2) the health care provider typically provides the services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products, or reports to the individual.

e.g. Radiologists and pathologists may have an indirect treatment relationship because they deliver diagnostic services based on the orders of other health care professionals and the results are furnished to the direct treating health care professional.

The health care provider must make a good faith effort to obtain the individual’s written acknowledgment of receipt of the notice. If the individual refuses to sign the written acknowledgment, the health care provider must document the good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained. During emergency treatment situations, the requirement for privacy of notice is delayed until reasonably practicable after the emergency situation and the health care provider is not required to make a good faith effort to obtain an individual’s written acknowledgment in an emergency situation.

HIPAA does not prescribe the specific form of the written acknowledgment. The covered entity has flexibility in preparing its own form.

For example, a health care provider can simply request the individual to initial a cover sheet that states that the individual has received a copy of the Notice of Privacy Practices or may request the individual to sign a separate sheet that states:

"I acknowledge that I have received a copy of the Notice of Privacy Practices for Protected Health Information from [name of medical practice]"

If the medical practice has a physical service site such as an office, the medical practice must: (a) have the notice available at the site for individuals to request to take with them; and (b) post the notice in a clear and prominent location where it is reasonable to expect individuals to be able to read the notice. If the medical practice maintains a website that provides information about the services and benefits of the medical practice, the notice must be prominently posted on the website.