Notice of Privacy Practices

The Notice of Privacy Practices is a document required by the Health Insurance Portability and Accountability Act (HIPAA) that informs you of how your health information may be used and disclosed by your healthcare provider or health plan. This notice outlines your privacy rights and the provider’s responsibilities in safeguarding your personal health information. There is no direct fee for receiving this notice; it is a standard part of your initial paperwork when you visit a new provider or enroll in a health plan. To ensure clarity about your privacy protections and how your data is handled, always request an itemized estimate of any related administrative charges, keep copies of all forms you sign, and ask for the notice if it is not provided.

Key Points About the Notice of Privacy Practices

• Included Components: Information on your rights, how your data may be used/shared, and how to file privacy complaints.
• When Provided: Usually at your first visit to a provider or when you enroll in a health plan. In emergencies, it is provided as soon as possible afterwards.
• Form Signing: You may be asked to sign a form confirming you received the notice; this is for documentation, not for consent to share your information.
• Access: The notice must be posted in a visible location and on the provider’s website, and you can request a copy at any time.

Insurance & Payment Advice

• No separate fee is charged for receiving the Notice of Privacy Practices.
• Administrative costs related to documentation are generally included in your overall visit or enrollment fees.
• Your signature does not authorize disclosure—it only confirms receipt of the notice.

Frequently Asked Questions

• What is the Notice of Privacy Practices? The Notice of Privacy Practices is a document that explains how your health information may be used and shared by your provider or health plan, and outlines your rights under HIPAA.
• Is there a cost for receiving the Notice of Privacy Practices? No, you are not charged separately for receiving this notice; it is provided as part of your care or insurance enrollment.
• Why do I need to sign a form about the Notice? The law requires providers to document that you received the notice, so your signature is simply an acknowledgment of receipt.
• What should I do if I did not receive the notice? You can request a copy from your provider or health plan at any time, and it should also be available on their website or posted in their office.
• Does signing mean I consent to share my health information? No, signing only confirms that you received the notice; it does not give permission to share your information beyond what HIPAA allows.
• Can I receive the notice in an emergency situation? Yes, if you are treated in an emergency, the notice must be provided as soon as possible after the emergency has passed.
• What rights does the notice explain? The notice explains your rights to access, amend, and request restrictions on your health information, as well as how to file a privacy complaint.
• Is the notice available online? Yes, providers and health plans that have a website must post the notice there for your convenience.
• Who can I contact with questions about my privacy? The notice includes contact information for your provider’s or health plan’s privacy officer, whom you can approach with any concerns or questions.
• Am I required to keep a copy of the notice? No, but it is a good idea to keep a copy for your records in case you have future questions about your privacy rights.

What is the HIPAA notice I receive from my doctor and health plan?

Your health care provider and health plan must give you a notice that tells you how they may use and share your health information. It must also include your health privacy rights. In most cases, you should receive the notice on your first visit to a provider or in the mail from your health plan. You can also ask for a copy at any time.

Why do I have to sign a form?

The law requires your doctor, hospital, or other health care provider to ask you to state in writing that you received the notice.

• The law does not require you to sign the “acknowledgement of receipt of the notice.” 
• Signing does not mean that you have agreed to any special uses or disclosures (sharing) of your health records. 
• Refusing to sign the acknowledgement does not prevent a provider or plan from using or disclosing health information as HIPAA permits. 
• If you refuse to sign the acknowledgement, the provider must keep a record of this fact.

What is in the Notice?

The notice must describe:

• How the Privacy Rule allows provider to use and disclose protected health information. It must also explain that your permission (authorization) is necessary before your health records are shared for any other reason
• The organization’s duties to protect health information privacy
• Your privacy rights, including the right to complain to HHS and to the organization if you believe your privacy rights have been violated
• How to contact the organization for more information and to make a complaint

When and how can I receive a Notice of Privacy Practices?

You’ll usually receive notice at your first appointment. In an emergency, you should receive notice as soon as possible after the emergency.

The notice must also be posted in a clear and easy to find location where patients are able to see it, and a copy must be provided to anyone who asks for one.

If an organization has a website, it must post the notice there.

A health plan must give its notice to you at enrollment. It must also send a reminder at least once every three years that you can ask for the notice at any time.

A health plan can give the notice to the “named insured” (subscriber for coverage). It does not also have to give separate notices to spouses and dependents.