Health Information Compliance Alert

Make these 5 key changes to your NPP before September.

If you don’t update your Notice of Privacy Practices (NPP) pursuant to the final omnibus rule by Sept. 23, you could face patient complaints, government investigations and even increased civil money penalties (CMPs).

In addition to many other HIPAA provisions, the recently enacted omnibus rule made five significant changes to the NPP. Make sure you modify and redistribute your NPP to all patients before the September deadline.

1. Uses & Disclosures Requiring Authorization: Your NPP must now include information regarding certain types of uses and disclosures of protected health information (PHI) that require authorization, according to the law firm Epstein Becker & Green in a white paper. These uses and disclosures requiring authorization include:

    a. Most uses and disclosures of psychotherapy notes;

    b. Uses and disclosures of PHI for marketing      purposes; and

    c. Disclosures that constitute a sale of PHI.

2. Separate Statements for Certain Uses & Disclosures: You must include in your NPP separate statements about certain activities, including:

    a. Intention to send patients treatment communications while receiving financial remuneration;

    b. Intention to contact individuals to raise funds; and

    c. The individual’s right to opt out of such communications.

3. Enhanced Patient Rights: Include in your NPP an explanation that you as the CE must agree to a patient’s request “to restrict disclosure of PHI to a health plan, if the disclosure is for payment or health care operations and pertains to a health care item or service for which the individual has paid out-of-pocket in full,” according to Epstein Becker & Green. Also revise your NPP to include other changes to patient rights, such as the right to receive electronic copies of health information.

4. Breach Notification Requirements: Your NPP should also include the new requirement of notifying patients when a breach occurs, says attorney Wayne J. Miller, Esq., founding partner of the Compliance Law Group in Los Angeles. Include a simple statement that an individual has a right to breach notifications of his unsecured PHI.

5. Appointment Reminders & Alternatives: The final rule removes the requirement that your NPP include a statement that the CE “may contact the individual to provide appointment reminders or information about treatment alternatives or other benefits and services that may be of interest to the individual,” states Epstein Becker & Green. So you no longer need to include this statement, but you can leave it in your NPP if you want.