- HIPAA Update - http://blogs.hcpro.com/hipaa -

HIPAA Q&A: Notices of privacy practices

[1]Q . May organizations include inserts in their current patients’ rights brochures with updated information about their right to receive their medical files electronically, or must they reprint their entire brochures? We have a backstock of brochures and prefer to use them before we reprint them.   

A. Reprinting the entire brochure is not required; an insert is permissible as long as it doesn’t contradict information in the actual notice. You should call this a notice of privacy practices (NPP) rather than a patient’s rights brochure because the latter includes rights unrelated to PHI, and there are specific things that must be included in each. Access sample NPPs at www.hhs.gov/ocr/privacy/hipaa/modelnotices.html [2]. Note that the HIPAA Omnibus Rule requires changes beyond the right to receive an electronic copy. Remember that the intent of the NPP is to explain to your patients what you are doing with their information and their rights pertaining to their PHI. Be sure to date your NPP and post the additional information prominently in your facility and on your website.

Editor’s note: This question was answered by Chris Simons, MS, RHIA, director of health information and privacy officer at Cheshire Medical Center/Dartmouth-Hitchcock in Keene, N.H. This information does not constitute legal advice. Consult legal counsel for answers t j o specific privacy and security questions. Send your HIPAA questions to Associate Editor Jaclyn Fitzgerald at jfitzgerald@hcpro.com [3].