• E-mail
• Print
• RSS

Are we required to use a "layered" notice of privacy practices??

HIPAA Weekly Advisor, April 18, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: The final privacy changes mention a "layered" notice of privacy practices. Are we required to use one?

A: Covered entities, while encouraged to use a layered notice, are not required to do so.

According to Section 164.520 of the final privacy changes, a layered notice of privacy practices should contain the following:

• A short notice that briefly describes the entity's principal uses and disclosures of an individual's health information, as well as the individual's rights with respect to that information
• A longer notice, layered beneath the short notice, which contains all the elements required by the rule

Consider providing a short notice that touches on key points, along with the regular notice of privacy practices. Make the short notice the first page of the whole packet.

The short notice should use simple vocabulary and consist of no more than seven elements. It's not a summary. It gives key points. A short notice cannot be a legally compliant notice or a substitute for a long notice.

A short notice should include the following:

1. Preamble
Include an explanation of the short notice and reference to the complete notice.

2. Common uses and disclosures
List the following:

• Treatment, payment, or health care operations
• Research
• Public health uses
• Fundraising
• Marketing (or communications to inform about health-related products and services, and to recommend other treatments and health care providers, which are exempt from the definition of marketing)
• Required by law

3. Rights and choices
Facilities must allow patients to do the following:

• Have access to PHI
• Request amendments
• Receive an accounting of disclosures
• Have information delivered to an alternate address
• Ask that information not be shared with friends or family members

4. Other important information
This section is optional, but facilities may choose to provide more information on fundraising, marketing, or other aspects of the privacy rule.

5. Contact information
List three ways patients can contact the facility.

Editor's note: Adapted from the May 2003 issue of Briefings on HIPAA and answered by Lisa J. Sotto, Esq., partner at Hunton & Williams, in New York. Sotto is also director of the Center for Information and Policy Leadership's HIPAA Highlights Notice Project.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive