In proposed § 164.518(a)(2), we would require a covered entity to designate a contact person or office to receive complaints and provide information about the matters covered by the entity’s notice. The covered entity could, but would not be required to, designate the designated privacy official as the entity’s contact person.
In proposed § 164.512, we would require the covered plan or provider’s privacy notice to include the name of a contact person for privacy matters. We would not require that the contact person and the designated privacy official be the same person. This would be left to the discretion of each covered entity.