This is the 4th in the HIPAA Checkups focused on the Office for Civil Rights (OCR) recently published Guidance documents that address the changes the within the Omnibus Rule.

The Omnibus Rule, published in January 2013, modifies the section in the Privacy Rule that is focused on the Notice of Privacy Practices (Notice). [See 45 CFR �164.520 Notice of privacy practices for protected health information].                             

Changes to the Notice, under the Omnibus Rule, affect the required statements that must be made in the Notice and affect requirements for provision of the Notice for Health Plans. In the Preamble to the rule OCR stated that many of the changes are material changes. In other words, the changes are major and will mean that you will have to update your Notice document.

Significant changes about Notice statements include:

• Clarification of what uses and disclosures require an authorization
• A new statement that uses and disclosures that are not described in the notice require an authorization
• If applicable, a statement that an individual has the right to opt out of receiving fund-raising communications
• If applicable for health plans (see the Rule for specifics), a statement that use or disclosure of genetic information for underwriting purposes is prohibited
• Clarification that a request for restriction of disclosure must be agreed-to if an individual self-pays in full for a provider's services
• Clarification that the covered entity is required to notify affected individuals following a breach of unsecured protected health Information.

For material changes to a health plan's Notice:

• A health plan that posts its Notice on its web site must post the changes by the effective day of the material changes and use its next annual mailing to provide information about the changes and how to obtain the revised Notice.
• There are no changes for provision of the Notice, if a health plan does not post its notice on its web site.

Click here for access to model notices developed by OCR and ONC.

As usual OCR has provided frequently asked questions within their guidance. For Notice of Privacy Practices FAQs, click here

Over the years, in our consulting engagements, we have seen Notices that were difficult to read and frequently following the exact language of the rule. In both our consulting and personal experiences we have observed providers who do not post the Notice; and in some cases support staff who don't know where to find the Notice! And in most cases, staff members do not know the purpose of the Notice nor understand the content.

What to do now:

• If you have not revised your Notice, review the model notices (see the link above) to get some ideas about what could work well for your covered entity
• Revise your notice
• Train your client-facing staff so that they understand the new notice and how to provide it on demand
• For providers, post your updated Notice where it is visible to all patients and visitors
•  For health plans, post your updated Notice on your website and notify members in your next annual mailing.