The Office for Civil Rights (“OCR”) published a Spanish version of its model Notice of Privacy Practices (“NPP”) on February 19, 2014. The English version of the OCR model NPP was published in September 2013 and comes in four formats (layered, booklet, full page and text) and two versions (one for health care providers and one for health plans). The model NPP can be found here. Commentators have noted that the model NPP is more user friendly and typically shorter than most NPPs that have been utilized by the industry. Reading level for the model NPP is Flesch-Kincaid Level 9.5.
Susan McAndrew, OCR Deputy Director for Health Information Privacy, promoted the model NPP during her speech on February 24, 2014 at the annual HIMSS conference.
The next version of the model NPP is expected to be digital. OCR has teamed up with the Office for the National Coordinator (“ONC”) to sponsor the Digital Privacy Notice Challenge. This program solicits industry participants to design effective online NPPs and awards prizes to winners. Click here for more information.
Covered entities are not required to use the model NPP. Those that elect to use the model may do so by simply filling in the blank fields. Covered entities may also use the model as a template to tailor in detail or as a reference guide to ensure their “homegrown” NPP meets the minimum requirements.
The HITECH Final Rule created some additional flexibility for NPPs. In lieu of posting the entire NPP, covered entities may post a “summary” NPP in their lobbies. Covered entities who elect to post a summary must remember to make copies of the full NPP available nearby, such as hard copies on a table under the posted summary. The first page of the model layered NPP may serve well as a summary NPP for lobby posting.
In the preamble to the HITECH Final Rule, OCR also reminded the industry of its obligations under other federal laws to make its NPP available in different languages for Limited English Proficient persons and alternate formats, such as Braille, large print or audio, for individuals with disabilities. The HITECH Final Rule may be found here.
Some other tips to keep in mind:
- Don’t forget to reference stricter state law in the NPP.
- Don’t forget to post the full NPP on your website.
- If you are issuing a Joint NPP, remember to reference the members of the OHCA relying on the Joint NPP, such as a hospital’s medical staff, when providing services at the hospital. (If you are not issuing a joint NPP, it is not necessary to list OHCAs or their other members.)
- You are not required to distribute the updated NPP to patients who received a prior version.
If you have further questions about NPPs or HIPAA compliance, please contact Elizabeth Callahan-Morris at 248.457.7854 or ecallahan@hallrender.com or your regular Hall Render attorney.
Hall Render’s HIPAA Impact Series has provided in-depth analysis of HIPAA issues and developments since the passage of HITECH. View our HIPAA Impact Series and sign up to receive updates by visiting www.hallrender.com/impact.
