HHS Develops Model Privacy Practice Notices for Health Plans and Providers

HHS’s Office for Civil Rights and Office of the National Coordinator for Health Information Technology have developed model Notices of Privacy Practices for health care providers and health plans to use to communicate with their patients and plan members.

The Notices are required under 45 CFR 164.520, which provides that an individual has a right to adequate notice of how a covered entity may use and disclose protected health information about the individual, as well as his or her rights and the covered entity’s obligations with respect to that information.

Under the regulations, a covered entity must make its notice available to any person who asks for it. A covered entity also must prominently post and make available its notice on any web site that it maintains, which provides information about the entity’s customer services or benefits.

Models and Guidelines

HHS developed four model notices for health plans and providers: a Notice in the form of a booklet; a layered notice that presents a summary of the information on the first page, followed by the full content on the following pages; a Notice with the design elements found in the booklet, but formatted for full page presentation; and a text-only version of the notice.

HHS also provided guidelines as to which Notice should be used and how the guidelines can be customized for plans or providers, including adding the names or logos of the plan or provider to the Notice.