Executive summary. Keep the privacy notice easy to find, and route patient questions to someone who can answer them on time and in writing.
Definition
A notice of privacy practices explains how a covered entity may use and disclose protected health information and describes individual rights.
Make the notice usable
Put the current notice where people can reasonably find it, and use clear language when staff explain it. A notice fails when a patient needs three handoffs to ask a basic question.
Keep a controlled copy of the version in use, and a simple process for updating materials when the notice changes.
Route questions without overpromising
Staff should be able to recognize a privacy question and know where to send it. Capture the patient’s contact preference, the question asked, and the date received.
Some requests carry formal timing and review requirements. A front-line response should acknowledge and route the request rather than decide it outside the organization’s process.
Frequently asked questions
Is a privacy notice the same as a patient authorization?
No. A notice explains privacy practices and rights. An authorization is a separate permission document used in circumstances where HIPAA requires it.
Referenced standards and further reading
- HHS OCR: Notice of Privacy Practices ↗U.S. Department of Health and Human Services
Related articles
HIPAA Security Rule risk analysis: scope, evidence, decisions →
The minimum necessary standard in operational design →
Business associate relationships: map the work, not the logo →