Q&A: Proper NPP procedures

Q: Does a Notice of Privacy Practices (NPP) have to be included in a lobby, or just handed out to patients during admission? What are good practices generally with the NPP?

A: Yes, the Privacy Rule requires that the notice be posted in a clear and prominent location where it is reasonable to expect those seeking healthcare services to read the notice. If you have a website that provides information about your services, you must also post the notice prominently on the website and make the notice available electronically through the website.

The notice must be written in plain language and contain specific elements listed in the Privacy Rule (see 45 CFR §164.520 for details).  

Editor's note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for Briefings on HIPAA. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions.