June 10, 2021

Whether you’re a self-appointed 5 star chef or an Uber Eats connoisseur, you know that skipping one small ingredient (or forgetting the guacamole on your Chipotle burrito) can throw the whole meal off. And while there aren’t many similarities between cooking up your famous casserole dish and implementing a complete HIPAA program – both require various steps that are each essential to the final product. So amongst the exhaustive list of HIPAA essentials like the Security Risk Analysis (SRA), annual staff training, business associate agreements, and more –  falls an important and often overlooked ingredient in achieving compliance, the Notice of Privacy Practices (NPP). 

What is it? 

Under the HIPAA Privacy Rule, covered entities are required to provide patients with a notice that states how their protected health information (PHI) will be used and shared. In a nutshell, the purpose of the document is to clearly outline the practices you have in place to protect the privacy of sensitive data (hence the name Notice of Privacy Practices) along with your organizations’ legal responsibilities and patients’ rights to their own PHI. 

What’s in it? 

Creating a proper notice requires a little prep work, so in looking at the meat and potatoes of what goes into this important HIPAA document, the NPP should include a description of the following: 

• How the Privacy Rule allows your organization to use and disclose PHI.
•  How patient authorization is necessary before their health records can be shared. 
• Your practice’s duties to protect the privacy of PHI.
• The patient’s privacy rights including their right to file complaints to the Office for Civil Rights (OCR) if they feel that their rights have been violated.
• Information on how patients can contact the OCR and formally file a complaint. 

How do I provide it?

It’s one thing to have all of the ingredients needed for the NPP but the part that often gets healthcare organizations in a pickle is determining how to properly securely serve it to patients. Typically, the notice is given to a patient at their first appointment along with other important documents like the HIPAA authorization form. But simply getting a copy signed once isn’t all that’s needed. Most practices don’t understand it’s a HIPAA requirement to also post the notice in a clear and easily accessible location to the patient. Additionally, if your practice has a website, a copy of the NPP should be posted and readily available there as well. 

Why is it so important? 

Compared to the many other more complex pieces of a complete HIPAA program, putting together a Notice of Privacy Practices seems almost as easy as whipping up a box of Kraft Mac and Cheese. However, according to the most recent HIPAA Audit Results, only 2% of covered entities fully met the NPP requirements while two-thirds failed to or made minimal or negligible efforts to comply. So why is there such an overwhelming amount of noncompliance for a relatively easy standard to meet? Well, the report found that many entities audited were able to submit some type of document but the majority could not provide a notice that was written in plain language and most were missing required content often related to individual rights. In addition to the widespread lack of proper content within the notice, the report also found that many entities failed to meet the prominently posted requirement. This meant that even if the entities had the notice and posted it on their website – if it wasn’t easily accessible from the website’s homepage it didn’t cut it in the OCR’s books. 

Some food for thought? Having a complete compliance program in place starts with following the recipe of HIPAA requirements. Ensuring that your practice has a properly written and accessible NPP might one be a small piece of the whole HIPAA pie – but just like forgetting to add yeast when baking the crust, missing one requirement – even if you have everything else in place – can cause all of your other compliance efforts to fall flat.