Notice of Privacy Practices

With the exception of inmates, an individual has the right to adequate notice of the uses and disclosures of their protected health information (PHI) that may be made by the covered entity and the covered entity's legal duties with respect to PHI. This notice is called the Notice of Privacy Practices (NPP).

As an organized health care arrangement (OHCA), a joint Notice of Privacy Practices will include privacy practices for all the covered entities in the OHCA. The covered entities participating in the OHCA agree to abide by the terms of the notice with respect to PHI created or received by the covered entity as part of its participation in the OHCA. For a list of entities under LLUH OHCA refer to page 12 of the Notice of Privacy Practices.

Front line employees such as patient intake, registration and front desk personnel in physician practice offices, ancillary clinics and outpatient and inpatient facilities, must provide patients with a copy of the Notice of Privacy Practices at their first visit/encounter at one of the OHCA entities. A good faith effort must be made to obtain patient acknowledgement of receipt. In an emergency treatment situation, we must provide the notice as soon as reasonably practicable after the emergency treatment situation. If an acknowledgement of patient receipt is not obtained, we must document our good faith efforts to obtain the acknowledgment and the reason why the acknowledgment was not obtained.

The notice is written in plain language and contain the following statement as a header:

''This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.''

The notice of privacy practices outlines the types of uses and disclosures that the covered entity is permitted by the law to make for each of the following purposes: treatment, payment, and health care operations (TPO).

The notice also contains a statement that other uses and disclosures will be made only with the individual's written authorization and that the individual may revoke such authorization as provided by the Rule.

Another example of a privacy practice that is listed on the notice is a statement that informs the individual that we may contact the individual to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the individual.

Individual rights

The notice contains a statement of the individual's rights with respect to PHI and a brief description of how the individual may exercise these rights.

Complaints

The notice contains a statement that individuals may complain to the covered entity and to the Secretary of the Department of Health and Human Services (DHHS) if they believe their privacy rights have been violated. It also contains a brief description of how the individual may file a complaint with the covered entity and a statement that the individual will not be retaliated against for filing a complaint.

Internet posting

We are required to prominently post the Notice of Privacy Practices on the Internet. The privacy practices within the institution must be consistent with what is stated in the Notice of Privacy Practices.

Revisions to the notice

The covered entity must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the individual's rights, the covered entity's legal duties, or other privacy practices stated in the notice. Except when required by law, a material change to any term of the notice may not be implemented prior to the effective date of the notice in which such material change is reflected.

Effective August 1, 2019, a revised NPP listing new patient rights replaced the previous version of September 23, 2013. The revised NPP must be distributed to all new patients seeking care at one of the OHCA facilities at the moment of their first encounter and be made readily available to current patients or the general public.

TOC | Next