The HIPAA Notice of Privacy Practices is the plain-language document that every health plan and most healthcare providers must give you, explaining how they can use and share your health information, what rights you have over that information, and how to act if you believe those rights have been violated. It is required by the HIPAA Privacy Rule, and it must be written so you can actually understand it. The form you sign at a new doctor’s office is tied to this notice, but signing does not mean what most people assume it means.
What the Notice Must Tell You
The Privacy Rule sets out exactly what the document must cover. It must describe, with at least one example, how the entity can use and share your information for treatment, payment, and healthcare operations without asking your permission first.1eCFR. 45 CFR 164.520 Notice of Privacy Practices for Protected Health Information Treatment covers things like sharing test results with a specialist. Payment includes submitting claims to your insurer. Operations is broader and covers quality reviews, training, and similar internal work.
The notice must also describe other situations where the law allows or requires disclosure without your authorization, such as public health reporting or a court order. Any use outside those categories needs your separate written authorization.
Beyond permitted uses, the document must state that the entity is required by law to protect your health information and to notify you if a breach of your unsecured information occurs.1eCFR. 45 CFR 164.520 Notice of Privacy Practices for Protected Health Information It must list your individual rights and explain how to exercise them, give contact information for a privacy office or contact person, and show an effective date.2HHS.gov. Notice of Privacy Practices for Protected Health Information You can always request a paper copy, even if you first received it electronically.
When You Should Receive One
Timing depends on the type of entity. A health plan must give you the notice when you enroll.3eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information After that, the plan must remind existing members at least once every three years that the notice is available and how to get it. If the plan makes a material change to its privacy practices, it must send a revised notice to covered members within 60 days.2HHS.gov. Notice of Privacy Practices for Protected Health Information
A healthcare provider with a direct treatment relationship must give you the notice no later than your first visit or service. If your first contact is electronic, the provider must send an electronic copy automatically with that first exchange.2HHS.gov. Notice of Privacy Practices for Protected Health Information In an emergency, the provider can delay delivery and give it to you as soon as reasonably possible afterward.
Every covered entity with a website describing its services must post the notice prominently online.2HHS.gov. Notice of Privacy Practices for Protected Health Information Providers with a physical location must keep copies there for anyone to pick up.
What Signing the Acknowledgment Actually Means
This is where most patients get confused. When the front desk hands you a form to sign, you are acknowledging that you received the notice. You are not agreeing to anything. You are not giving permission for disclosures that would otherwise need your written authorization. The provider’s ability to use your information for treatment, payment, and operations comes from the law itself, not from your signature.4HHS.gov. Notice of Privacy Practices
Providers must make a good faith effort to get your written acknowledgment, but you can refuse to sign. If you do, the provider documents the refusal and moves on.4HHS.gov. Notice of Privacy Practices Refusing does not stop the provider from treating you and does not change what HIPAA already allows them to do with your information. The acknowledgment requirement applies only to providers with direct treatment relationships, not to health plans.
The Rights the Notice Describes
The notice is not just informational. It is the document that tells you about rights you can actually exercise, gathered from several parts of the Privacy Rule into one place.
- Access your records. You can inspect and get a copy of your health information in the designated record set. The entity must respond within 30 days, with one possible 30-day extension if it gives you a written reason for the delay. A few narrow categories are excluded, such as psychotherapy notes and information compiled for legal proceedings.5eCFR. 45 CFR 164.524 Access of Individuals to Protected Health Information
- Request an amendment. If something in your record is inaccurate or incomplete, you can ask the entity to correct it. It can deny the request in certain cases, but must give you a written explanation.
- Request restrictions. You can ask the entity to limit how it uses or shares your information for treatment, payment, or operations. It generally doesn’t have to agree, with one important exception: if you pay for a service entirely out of pocket and ask the provider not to disclose it to your health plan, the provider must honor that request.
- Request confidential communications. You can ask to be contacted a specific way or at a different address, for example appointment reminders sent to a P.O. box rather than your home.
- Get an accounting of disclosures. You can request a list of certain disclosures the entity has made, though routine disclosures for treatment, payment, and operations are typically excluded.
- Receive breach notification. If your unsecured health information is compromised, the entity must notify you.1eCFR. 45 CFR 164.520 Notice of Privacy Practices for Protected Health Information
- File a complaint. You can complain to the entity directly or to the U.S. Department of Health and Human Services if you believe your rights have been violated.
What Copies of Your Records Can Cost
The right to access is not always the right to free copies. A covered entity can charge a reasonable, cost-based fee that covers only the labor for copying, supplies such as paper or a USB drive, postage if you want the records mailed, and preparation of a summary if you request one and agree to it in advance.6HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
What the entity cannot charge for: searching and retrieving records, verifying your identity, and general overhead. Per-page fees are not allowed for copies of records maintained electronically. For an electronic copy of an electronic record, the entity may use a flat fee of up to $6.50 covering all labor, supplies, and postage.7HHS.gov. $6.50 Flat Rate Option is Not a Cap on Fees That figure is an optional simplification, not a cap on every kind of record fee; paper copies of paper records still fall under the general cost-based standard. HHS encourages entities to provide copies free of charge, and an entity can never withhold your records because you owe them money.6HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
If you only want to look at your records in person without taking a copy, the entity cannot charge you anything.6HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
Who Has to Give You a Notice
The requirement applies to “covered entities,” which HIPAA defines as three groups: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for billing, eligibility checks, or similar transactions.8eCFR. 45 CFR 160.103 – Definitions If your doctor’s office bills insurers electronically, it is a covered entity and owes you a notice.
A few gaps are worth knowing about. Correctional institutions that are covered entities are exempt, and inmates do not have a right to the notice.1eCFR. 45 CFR 164.520 Notice of Privacy Practices for Protected Health Information Certain group health plans that provide benefits only through insurance contracts and don’t create or receive protected health information (other than summary or enrollment data) are also excused.2HHS.gov. Notice of Privacy Practices for Protected Health Information Business associates, such as billing companies or cloud vendors that handle health data for a covered entity, do not have to create their own notice; their obligations flow through the covered entity’s contract with them.9HHS.gov. Does the HIPAA Privacy Rule Require a Business Associate to Create a Notice of Privacy Practices
How to Complain if a Right Is Violated
If a provider or plan fails to give you a notice, ignores a right the notice describes, or otherwise mishandles your information, you can file a complaint with the HHS Office for Civil Rights (OCR). The most direct route is the OCR Complaint Portal on the HHS website, and you can also submit in writing.10HHS.gov. Filing a Health Information Privacy Complaint There is no filing fee, and you do not need a lawyer. Because the notice itself has to include contact information for the entity’s privacy office, you can also raise concerns with the provider or plan directly before going to OCR.