Having problems with message search?
Question
Is a health plan required to periodically notify enrollees about the availability, and how to obtain a copy, of its Notice of Privacy Practices?
Answer
Yes. The Privacy Rule requires a health plan to remind enrollees of the availability of its Notice of Privacy Practices, as well as how to obtain a copy, no less frequently than once every 3 years. See 45 CFR 164.520(c)(1)(ii).
Health plans may satisfy this requirement in a number of ways, including by:
• Sending a copy of their Notice of Privacy Practices.
• Mailing only a reminder concerning the availability of the Notice of Privacy Practices and information on how to obtain a copy.
• Including in a plan-produced newsletter or other publication information about the availability of the Notice of Privacy Practices and how to obtain a copy.
Health plans already may have satisfied the reminder requirement in a number of ways. For instance, a health plan may have adopted the practice of sending its Notice of Privacy Practices to subscribers and enrollees annually. Or, a health plan may have substantially amended its Notice of Privacy Practices recently, and thus, sent the revised Notice to its subscribers and enrollees as required by the Privacy Rule. See 45 CFR 164.520(c)(1)(i)(C). Moreover, a plan may have included information regarding the availability of its Notice of Privacy Practices in annual communications sent to subscribers and enrollees of the plan.
A health plan can satisfy the requirement by providing the reminder notice to the named insured of a policy under which coverage is provided to that named insured and one or more dependents. See 45 CFR 164.520(c)(1)(iii). For instance, if an employee of a firm and her three dependents are covered under a single health plan policy, that health plan can satisfy the reminder requirement by sending information concerning the availability of the Notice of Privacy Practices to just the employee, rather than to the employee and each dependent.
This information is especially timely as the third anniversary of the compliance date of the HIPAA Privacy Rule nears. Health plans, other than small health plans, were first required to distribute their Notice of Privacy Practices to subscribers and enrollees by April 14, 2003. Thus, those health plans that have not already reminded subscribers and enrollees in some manner of the availability of their Notice of Privacy Practices and how they may obtain a copy, must do so no later than April 14, 2006. For small health plans, which had until April 14, 2004, to first distribute their Notices of Privacy Practices, the compliance date for the triennial reminder notice requirement is April 14, 2007. These plans can begin to prepare now to meet this requirement using the most efficient means, such as including the reminder notice of the availability of the Notice of Privacy Practices in open enrollment materials, a group health plan newsletter provided to all members, or similar all-member mailings.
Health plans may satisfy this requirement in a number of ways, including by:
• Sending a copy of their Notice of Privacy Practices.
• Mailing only a reminder concerning the availability of the Notice of Privacy Practices and information on how to obtain a copy.
• Including in a plan-produced newsletter or other publication information about the availability of the Notice of Privacy Practices and how to obtain a copy.
Health plans already may have satisfied the reminder requirement in a number of ways. For instance, a health plan may have adopted the practice of sending its Notice of Privacy Practices to subscribers and enrollees annually. Or, a health plan may have substantially amended its Notice of Privacy Practices recently, and thus, sent the revised Notice to its subscribers and enrollees as required by the Privacy Rule. See 45 CFR 164.520(c)(1)(i)(C). Moreover, a plan may have included information regarding the availability of its Notice of Privacy Practices in annual communications sent to subscribers and enrollees of the plan.
A health plan can satisfy the requirement by providing the reminder notice to the named insured of a policy under which coverage is provided to that named insured and one or more dependents. See 45 CFR 164.520(c)(1)(iii). For instance, if an employee of a firm and her three dependents are covered under a single health plan policy, that health plan can satisfy the reminder requirement by sending information concerning the availability of the Notice of Privacy Practices to just the employee, rather than to the employee and each dependent.
This information is especially timely as the third anniversary of the compliance date of the HIPAA Privacy Rule nears. Health plans, other than small health plans, were first required to distribute their Notice of Privacy Practices to subscribers and enrollees by April 14, 2003. Thus, those health plans that have not already reminded subscribers and enrollees in some manner of the availability of their Notice of Privacy Practices and how they may obtain a copy, must do so no later than April 14, 2006. For small health plans, which had until April 14, 2004, to first distribute their Notices of Privacy Practices, the compliance date for the triennial reminder notice requirement is April 14, 2007. These plans can begin to prepare now to meet this requirement using the most efficient means, such as including the reminder notice of the availability of the Notice of Privacy Practices in open enrollment materials, a group health plan newsletter provided to all members, or similar all-member mailings.
See the email below for additional information.
Regards,
Share HIPAA
-=-=-=-=-=-=-
"PrivacyList, OCR (HHS/OS)" <OCRPrivacyList@...> wrote:
Dear Privacy Listserv Subscriber:
We want to make you aware of a new Frequently Asked Question (FAQ) on our website, which reminds health plans that the Privacy Rule requires them to notify enrollees about the availability, and how to obtain a copy, of their Notice of Privacy Practices no less frequently than once every 3 years. Thus, health plans that have not already reminded enrollees of the availability of their Notice of Privacy Practices and how enrollees may obtain a copy, must do so no later than April 14, 2006 (small health plans have until April 2007). You can readily access this new FAQ from the "What's New" column on the OCR website, http://www.hhs.gov/ocr/hipaa/, by clicking on "FAQ on Health Plans Reminding Enrollees About the Availability of the NPP."
We want to make you aware of a new Frequently Asked Question (FAQ) on our website, which reminds health plans that the Privacy Rule requires them to notify enrollees about the availability, and how to obtain a copy, of their Notice of Privacy Practices no less frequently than once every 3 years. Thus, health plans that have not already reminded enrollees of the availability of their Notice of Privacy Practices and how enrollees may obtain a copy, must do so no later than April 14, 2006 (small health plans have until April 2007). You can readily access this new FAQ from the "What's New" column on the OCR website, http://www.hhs.gov/ocr/hipaa/, by clicking on "FAQ on Health Plans Reminding Enrollees About the Availability of the NPP."
We are pleased to be able to keep you informed about these and other new resources available to
assist you in understanding the HIPAA Privacy Rule.
**********************************************************************
This email is being sent to you from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.
This is an announce-only list, a resource to distribute information about the HIPAA Privacy Rule. For additional information on a wide range of topics about the the Privacy Rule, please visit the OCR Privacy website at www.hhs.gov/ocr/hipaa/. You can also call the OCR Privacy toll-free phone line at (866) 627-7748. Information about OCR's civil rights
authorities and responsibilities can be found for the OCR home page at www.hhs.gov/ocr
If you believe that a person or organization covered by the Privacy Rule (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy Rule, you may file a complaint with OCR. For additional information about how to file a complaint, see the Fact Sheet "How to File a Health Information Privacy Complaint," available at http://www.hhs.gov/ocr/privacyhowtofile.htm .
To subscribe to or unsubscribe from the list serv, please go to:
http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.
Offline 
Send Email