Privacy Notice - Requirements Must be written in plain language and contain required elements Header statement “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.” June 2014 HIPAA - Privacy Practices Notice

Privacy Notice - Requirements Description (incl. at least 1 example) of the types of uses/disclosures for each of the following purposes: treatment/payment/health care operations Description of other purposes permitted or required without the individual’s written authorization Statement that other uses/disclosures will made only with written authorization and that this authorization may be revoked June 2014 HIPAA - Privacy Practices Notice

Privacy Notice - Requirements Separate statement for certain uses/disclosures: HCP may contact the individual to provide appointment reminders or info about alternative tx or other health-related benefits that may be of interest June 2014 HIPAA - Privacy Practices Notice

Privacy Notice - Requirements Statement of Individual Rights Right to request restrictions on certain uses/disclosures of PHI (ensure it is clear you are NOT required to agree to the request) Right to receive confidential communications of PHI Right to inspect and copy PHI Right to amend PHI Right to receive an accounting of disclosures of PHI Right to receive a paper copy of this Notice upon request (you may email it but if not received you must be ready to provide a paper copy) June 2014 HIPAA - Privacy Practices Notice

Privacy Notice - Requirements Statement that you are required by law to “maintain the privacy of PHI and to provide individuals with notice of your legal duties and privacy practices with respect to PHI” Statement that you are required to abide by the terms of the notice currently in effect Statement that you reserve the right to change the terms of your notice and to make the changes effective for all PHI you maintain (include statement on how you will provide a revised notice to the individual) June 2014 HIPAA - Privacy Practices Notice

Privacy Notice – Requirements Statement that individuals may file a complaint to the HCP and the Secretary of HHS if they believe their “privacy rights have been violated” Brief description of how to file the complaint with the HCP Statement of no retaliation for filing a complaint June 2014 HIPAA - Privacy Practices Notice

Privacy Notice - Requirements Contact Info Name Title Telephone # Effective Date Date on which the notice is first in effect May not be earlier than date of print / publish June 2014 HIPAA - Privacy Practices Notice

Privacy Notice – Providing to the Individual No later than first service delivery Personal visit: in person Telephone: mailing Electronic: electronic means Emergencies – as soon as reasonable Offices: Hard copies available Posted in a “clear and prominent location where it is reasonable to expect individuals seeking services to be able to read the notice” Web sites: Any site providing info about services or benefits Copy must be available electronically via the site Revised notice: Copies must be available upon effective date of change June 2014 HIPAA - Privacy Practices Notice

Is a Patient Acknowledgement needed? HCP must make a “good faith effort” to obtain written acknowledgement of receipt of the Notice Content is not specified If unable to obtain acknowledgement, HCP must document the reason why HCP is relieved of need to request in an emergency June 2014 HIPAA - Privacy Practices Notice

Privacy Notice – Documentation HCP must make a “good faith effort” to obtain a written acknowledgment of the receipt of the notice If not obtained, document your “good faith efforts” and reason why it was not obtained Be sure to retain copies of any notices you issue June 2014 HIPAA - Privacy Practices Notice