45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information

What this rule requires your agency to do

• 1Promptly revise and distribute the notice whenever there is a material change to uses/disclosures, individual rights, legal duties, or privacy practices, and not implement a material change before its effective date except when required by law (§ 164.520(b)(3)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 2Document compliance with the notice requirements by retaining copies of notices issued and any written acknowledgments of receipt or documentation of good faith efforts to obtain them (§ 164.520(e)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 3Make the notice available on request to any person, and satisfy the plan-specific and provider-specific provision requirements — including a provider giving notice no later than first service delivery and making a good faith effort to obtain written acknowledgment (§ 164.520(c)(1)-(2)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 4Include in the notice statements of the covered entity's duties, complaint rights (to the entity and the Secretary, without retaliation), a contact person or office, and the notice's effective date (§ 164.520(b)(1)(v)-(viii)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 5If maintaining a web site with information about services or benefits, prominently post the notice on the web site and make it available electronically; provide e-mail notice only where the individual agrees, and provide a paper copy if e-mail transmission fails (§ 164.520(c)(3)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 6Provide individuals with adequate notice of the uses and disclosures of PHI the covered entity may make and of the individual's rights and the covered entity's legal duties with respect to PHI, except for the group health plan and inmate exceptions (§ 164.520(a)(1), (a)(3), (a)(4)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 7Include in the notice a statement of individual rights — to request restrictions, request confidential communications, inspect and copy, amend, receive an accounting of disclosures, and obtain a paper copy (§ 164.520(b)(1)(iv)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)
• 8Provide a plain-language notice containing all required elements, including the prescribed header, descriptions of permitted uses and disclosures (with examples for treatment, payment, and health care operations), uses requiring authorization, and prohibited uses under § 164.502(a)(5)(iii) (§ 164.520(b)(1)).(45 CFR 164.520 — HIPAA Privacy Rule: Notice of Privacy Practices for Protected Health Information)