NRPM: Standards for Privacy of Individually Identifiable Health Information. b. Revising the notice.


We are proposing that covered plans and providers be permitted to change their policies and procedures at any time. Before implementing a change in policies and procedures, the covered plan or provider must revise its notice accordingly. However, where the covered plan or provider determines that a compelling reason exists to take an action that violates its notice, it may do so only if it documents the reason supporting the action and revises its notice within 30 days of taking such action. The distribution requirements that would apply when the notice has been materially revised are discussed in detail below.