We propose that the notice be required to identify a contact person or office within the covered plan or provider to receive complaints, as provided in proposed § 164.518(a)(2), and to help the individual obtain further information on any of the issues identified in the notice. A specific person would not need to be named in the notice. It could be an office or general number where someone who can answer privacy questions or concerns can be reached.
In § 164.518(d), we are proposing that covered plans and providers permit individuals to submit complaints to the covered entity. We are proposing that the contact person identified in the notice be responsible for initially receiving such complaints. The contact person might or might not be responsible for processing and resolving complaints, but, if not, he or she would forward the complaints to the appropriate personnel or office. See discussion of the complaint process in section II.G.4, below.
In addition to receiving complaints, the contact person would be able to help the individual obtain further information on any of the issues identified in the notice. The contact person would be able to refer to the documented policies and procedures required by proposed § 164.520. We would not prescribe a formal method for responding to questions.
The administrative requirements section below, proposed § 164.518(a), would also require the entity to designate an official to develop policies for the use and disclosure of protected health information and to supervise personnel with respect to use and disclosure of protected health information. We would not require this official to also be the contact person. Depending on the size and structure of the entity, it might be appropriate to require one person to fill both roles.