Health Information Compliance Alert

Question: The entire front-office staff collaborated on a fact sheet about the privacy and security rules to give to new patients in place of our four-page notice of privacy practices (NPP). After patients read and sign the fact sheet, we give them a copy to take home. We only give them the full NPP if they request it. Are we violating the privacy rule?


Minnesota Subscriber


Answer: It depends, confirms Kelley Meeusen, privacy officer at Harrison Hospital in Bremerton, WA.

The privacy rule states that providers "must provide the notice no later than the first service delivery " (Sec. 164.520[c][2]). However, it does not explicitly state what form the notice must come in.

Good idea: Don't toss out your full NPP on the chance you might not have to provide it. You should make your notice available, but you can offer patients the opportunity to turn down the full notice in favor of the fact sheet, Meeusen suggests.

The bottom line: The last thing a medical office needs is to hinge its compliance program on a few pieces of paper. Make your notice available to all patients--and be sure to obtain their written acknowledgement of your office's efforts.