Notice of Privacy Practices
What is the HIPAA notice I receive from my doctor and my health plan?
Your healthcare provider and your health plan must provide you with a notice that explains how they may use and share your medical information. It should also include your health privacy rights. In most cases, you should receive the notice at your first visit to a provider or by mail from your health plan. You can also request a copy at any time.
Why do I have to sign a form?
The law requires your doctor, hospital, or other healthcare provider to ask you to acknowledge in writing that you received the notice.
The law does not require you to sign the “acknowledgment of receipt of the notice.”
Signing does not mean you have accepted any special use or disclosure (sharing) of your medical records.
Refusing to sign the acknowledgment of receipt does not prevent a provider or plan from using or disclosing medical information as permitted by HIPAA.
If you refuse to sign the acknowledgment of receipt, the provider must keep a record of this fact.
What does the Notice contain?
Hospital Workers The notice must describe:
- How the Privacy Rule allows the provider to use and disclose protected medical information. It should also explain that your permission (authorization) is necessary before your medical records can be shared for any other reason.
- The organization’s obligations to protect the privacy of medical information.
- Your privacy rights, including the right to file a complaint with HHS and the organization if you believe your privacy rights have been violated.
- How to contact the organization for more information and to file a complaint.
When and how can I receive a Notice of Privacy Practices?
- Generally, you will receive a notice at your first appointment. In emergencies, you should receive the notice as soon as possible after the emergency.
- The notice must also be posted in a clear and easy-to-find location where patients can see it, and a copy must be provided to anyone who requests it.
- If an organization has a website, it must post the notice there.
- A health plan must provide you with its notice at the time of enrollment. It should also send a reminder at least once every three years so that you can request the notice at any time.
- A health plan may send the notice to the “designated insured” (subscriber of the coverage). There is no need to send separate notices to spouses and dependents.
Content created by the Office for Civil Rights (OCR)
Last reviewed on November 2, 2020
