NRPM: Standards for Privacy of Individually Identifiable Health Information. ii. Health care providers.


We are proposing to require that covered health care providers provide a copy of the notice to every individual served at the time of first service delivery, that they post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the provider to be able to read the notice, and that copies be available on-site for individuals to take with them. In addition, we are proposing to require that covered health care providers provide a copy of the notice to individuals they are currently serving at their first instances of service delivery within a year of the effective date of the final rule.

We would not require health care providers to mail or otherwise disseminate their notices after giving the notice to individuals at the time of the first service delivery. Health care providers’ patient lists may include individuals they have not served in decades. It would be difficult for providers to distinguish between “active” patients, those who are seen rarely, and those who have moved to different providers. While some individuals will continue to be concerned with the information practices of providers who treated them in the distant past, overall the burden of an active distribution requirement would not be outweighed by improved individual control and privacy protection.

We recognize that some health care providers, such as clinical laboratories, pathologists and mail order pharmacies, do not have face-to-face contact with individuals during service delivery. Such providers would be required to provide the required notice in a reasonable period of time following first service delivery, through mail, electronic notice (i.e. e-mail), or other appropriate medium. For example, a web-based pharmacy could meet this distribution requirement by providing a prominent and conspicuous link to its notice on its home page and by requiring review of that notice before processing an order.

If a provider wishes to make a material change in the information practices addressed in the notice, it would be required to revise its notice in advance. After making the revision, the provider would be required to post the new notice promptly. We believe that this approach creates the minimum burden for health care providers consistent with giving individuals a clear source of accurate information.