Health Information Management

Q&A: Notices of privacy practices

HIM-HIPAA Insider, February 16, 2009

Q. Do notices of privacy practices (NPP) apply to business associates of a covered entity, such as a billing agency for a hospital?

A. A covered entity (e.g., a hospital) issues an NPP to tell patients what information it collects about them, how it will use that information, and what patients’ rights are with respect to their information. The NPP does not provide any specific protection for the hospital, and it does not apply to business associates, such as a billing agency. However, the covered entity (hospital) must have a business associate agreement with the billing agency to protect the information the billing agency can access.

Editor's note: Mary Brandt, president of Bellaire, TX-based Brandt & Associates, LLC, answered this question. This is not legal advice. Consult your attorney regarding legal matters.

Most Popular