Section 164.512 would require covered entities to provide written notice of the entities’ privacy practices, rights, and procedures that meet the requirements of this section to affected parties upon request and as summarized below.
Health plans would provide a copy of the notice to an individual covered by the plan at enrollment and whenever the content of the notice is significantly altered thereafter, but no less frequently than once every three years. Total notice counts are estimated to be about 230 million, assuming plans choose to send them out annually rather than keeping track of duration since last notice. The average number of notices per plan per year would be about 1,200. For the approximately 19,000 plans issuing notices, the number of notices can be as few as 1,000 for a small self-insured self-administered employer, or as many as a million or more for a large commercial insurer or HMO. We further estimate that it will require each plan, on average, 8 hours to disseminate the required notices. This estimate is based upon the assumption that the required notice will be incorporated and disseminated with a plan’s annual policy materials. The total burden associated with this requirement is calculated to be 151,800 hours.
Health care providers would provide a copy of the notice to an individual at the time of first service delivery to the individual, provide as promptly as possible a copy of the notice to an individual served by the provider whenever the content of the notice is significantly altered, post a copy of the notice in a location where it is reasonable to expect individuals seeking services from the provider to be able to read the notice, and date each version of the notice. Total notices in the first year are estimated to be about 700 million (based on annual patient contacts with hospitals, physicians, and other providers), with subsequent year counts of 350 million. Small providers could be providing 400 or fewer notices (based on 150 million persons with ambulatory physician contacts per year and approximately 370,000 physician offices). The overall average will also be close to that amount, since the bulk of providers are small entities. Large providers could be sending out 3,000 or more notices (based on 20 million persons with hospitalizations and approximately 6600 hospitals). We further estimate that it will require each provider, on average, 8 hours to disseminate the required notices. This estimate is based upon the assumption that the required notice will be incorporated into and disseminated with other patient materials. The total burden associated with this requirement is calculated to be 7,122,152 hours.