What does the update to the notice of privacy practices require?

Legally Speaking

Clifford Warren Lober

Dr. Lober is a dermatologist in practice in Florida and a partner in the law firm Lober, Brown, and Lober.

Bookmark and Share

It’s a beautiful Wednesday afternoon as Bryan returns to his office from the courtroom. As soon as he walks in, his receptionist tells him Ellen has called about one of her patients. Bryan calls her back.

Bryan: Ellen, it’s great to hear from you! It’s been a while.

Ellen: Bryan, I have a peculiar situation. One of our new patients refused to sign the Notices of Privacy Practices acknowledgment form that we are required to have signed according to HIPAA. My receptionist told her that we could not see her unless she signed the form. Was she right?

Bryan: Actually, no. While you are correct that your receptionist should always have patients read and sign the form acknowledging that they have received your Notice of Privacy Practices when they first come to your office, you should not refuse to see them solely because they refuse to sign the acknowledgment form. You must, however, document that the Notice was given to them and that they refused to sign the acknowledgment.

Ellen: Are there any circumstances under which I don’t need to give the patient the Notice?

Bryan: Yes. Emergency situations are an exception. Although it is not required by HIPAA, you may want to give the Notice to the next of kin and have them acknowledge receipt. This documents your intent to comply with the spirit of the law. In any case, as soon as the patient is stable and capable of understanding the nature of the Notice, he or she should be given a copy and sign a written acknowledgment of its receipt.

Ellen: Must I give a copy of the revised Notice to my existing patients as well as to new patients? [pagebreak]

Bryan: I know that there has been some confusion on this question. The Final Rule explicitly states that providers are “only required to give a copy of the NPP to, and obtain a good faith acknowledgment of receipt from, new patients.” The revised Notice needs to be “available upon request” to existing patients. Nevertheless, many of my legal colleagues recommend that you give the revised Notice to all patients and have them sign an acknowledgment form since it again shows your intent to comply with the spirit of the law. This may be beneficial should a legal situation arise.

Ellen: In addition to giving the Notice to my patients and having them sign for it, is there anything else I need to do with it?

Bryan: Yes. You must post it in a “clear and prominent location” in your office. Providers may post a summary of the Notice “as long as the full notice is immediately available (such as on a table directly under the posted summary) for individuals to pick up without any additional burden on their part.” If you have a website, the Notice should be posted there as well.

Ellen: Our receptionist is still giving out copies of the older Notice since we have quite a few left in the office. That saves a few trees!

Bryan: Although I also love to save trees, you must use the revised Notice that we prepared for your practice. Several significant changes took effect on Sept. 23, 2013, and must be mentioned in your Notice of Privacy Practices. Discard the older forms since they no longer comply with the current law.

Ellen: I understand that the Notice must inform the patients that if they self-pay for their health care services in full they have the right to request that we not report the visit or treatment to their health plan. Is that true?

Bryan: That’s correct. If a patient pays out-of-pocket and in full, he or she may request that you not disclose that information to a health care plan for purposes of payment or health care operations. This must be mentioned in your revised Notice. [pagebreak]

Ellen: What else must be mentioned in the Notice?

Bryan: Your Notice must state that, in addition to their right to restrict certain disclosures to health plans when they pay out-of-pocket and in full, patients have the right to access, inspect, amend, and receive a copy of their protected health information. Your Notice should also spell out which disclosures the practice is allowed to make without patient authorization (so-called “permitted disclosures”), including those made for treatment, payment, or health care operations. And it should spell out which disclosures required the patient’s permission. The revised Notice must also mention that patients have the right to be informed of unauthorized disclosures of their protected health information as well as the right to file complaints with both your office and the Office for Civil Rights.

Ellen: Is that all?

Bryan: No. If you are going to use any of the patient’s protected health information for marketing, sales, or fundraising activities, you must get their prior permission. There are a few well-defined exceptions, such as face-to-face marketing. Even if you receive non-monetary compensation, such as a cruise or theater tickets, you must disclose that you are being compensated and get the patient’s permission. If you review the revised Notice that we prepared for your practice last September, you will see that all of the items we discussed, as well as others, are mentioned. You should also be aware that state laws frequently impose additional requirements on sales, marketing, and fundraising activities that involve protected health information.

Ellen: Wow! Should any of these changes affect my other office forms?

Bryan: Yes. Although not required, mentioning the restrictions on sales, marketing, and fundraising activities using protected health information on your financial form (in addition to your Notice) would again show your intent to both inform your patients and comply with financial and privacy laws. You may also want to mention the ability of a patient who self-pays in full for treatment to withhold that information from health care plans for purposes of payment or health care operations.

Ellen: Thanks, Bryan.

Bryan: You’re welcome. Please call me if I can be of any further help.

If you have any suggestions for topics to be discussed in this column, please e-mail them to me at loberc@gmail.com. See the February 2013 issue of Dermatology World for disclaimers. 



Key points
AAD website, manual can help dermatologists comply with HIPAA