It is important to remember that federal law strictly regulates when health plans need to provide their HIPAA Privacy Notice or Notice of Privacy Practices (NPP).
Many covered entities fail to document the different times a participant may be required to receive their NPP.
Under HIPAA, individuals in a covered health plan have a right to receive the NPP (1) at enrollment, (2) with changes, (3) on request, (4) on plan website, and (5) a reminder about the NPP every 3 years.
Failure to follow these rules may include penalties from HHS. If you need help understanding these notice rules or other parts of HIPAA Privacy, please contact Kinney & Larson.