Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Section 164.520 - Notice of Privacy Practices for Protected Health Information

12/28/2000

Except in certain circumstances set forth in this section, individuals have a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information. To comply with this requirement a covered entity must provide a notice, written in plain language, that includes the elements set forth in this section. For health plans, there will be an average of 160.2 million notices each year. We assume that the most efficient means of distribution for health plans will be to send them out annually as part of the materials they send to current and potential enrollees, even though it is not required by the regulation. The number of notices per health plan per year would be about 10,570. We further estimate that it will require each health plan, on average, only 10 seconds to disseminate each notice. The total annual burden associated with this requirement is calculated to be 267,000 hours. Health care providers with direct treatment relationships would provide a copy of the notice to an individual at the time of first service delivery to the individual, make the notice available at the service delivery site for individuals to request and take with them, whenever the content of the notice is revised, make the notice available upon request and post the notice, if required by this section, and post a copy of the notice in a location where it is reasonable to expect individuals seeking services from the provider to be able to read the notice. The annual number of notices disseminated by all providers is 613 million. We further estimate that it will require each health care provider, on average, 10 seconds to disseminate each notice. This estimate is based upon the assumption that the required notice will be incorporated into and disseminated with other patient materials. The total annual burden associated with this requirement is calculated to be 1 million hours.

In addition, a covered entity must document compliance with the notice requirements by retaining copies of the notices issued by the covered entity. Refer to § 164.530 for discussion.