OCR Releases Model Notices Of Privacy Practices

Under the Privacy Rule,  an individual has the right to adequate notice of how a covered entity may use and disclose PHI about the individual, as well as his/her rights and the covered entity's obligations with respect to that information.   Thus, a covered entity must develop and provide to individuals with a Notice of Privacy Practices (NPP).  See 45 C.F.R. § 164.520.   Under the Privacy Rule, a covered entity is also required to promptly revise its NPP when there is a material change to any of its privacy practices stated in the NPP to ensure that individuals are aware of their health information privacy protections and rights.  In January 2013, the Final Rule brought a number of material changes to the privacy obligations of HIPAA covered entities, and thus, NPPs must be revised to reflect such changes.