Notice of Privacy Practices: What Patients Should Know
Quick Answer
A Notice of Privacy Practices is a required HIPAA document that explains how your healthcare provider uses, protects, and discloses your medical information. Every covered healthcare provider must give you this notice before providing care. The notice describes your privacy rights and lists how your information can be legally shared with others.
What is a Notice of Privacy Practices?
The Notice of Privacy Practices is a formal document that describes a healthcare provider's privacy policies. It's your introduction to your HIPAA patient rights and explains how your healthcare provider collects, uses, stores, and shares your protected health information.
Key Information Included in the Notice
- How the provider uses your health information internally
- When and how your information may be disclosed to others
- Your right to access, amend, and receive an accounting of your records
- Your right to request restrictions and confidential communications
- How to file privacy complaints
- The provider's privacy practices and safeguards
- Contact information for the privacy officer
- Effective date and date of last revision
Why You Should Care About This Notice
- It explains your rights as a patient regarding your health information
- It shows how your information can be legally used and shared
- It identifies what you can do if you disagree with the provider's practices
- It provides contact information for raising privacy concerns
- It details how you can access and control your medical records
When and How You'll Receive the Notice
Timing Requirements
Healthcare providers must give you their Notice of Privacy Practices:
- At your first visit or healthcare encounter
- Before they disclose your information to others
- Upon request at any time
- In electronic format if the provider uses electronic communications
Delivery Methods
- In person at your appointment
- By mail
- By email
- Via patient portal
- Posted on the provider's website
- On display in the office waiting area
What You'll Usually Be Asked to Do
Many providers ask you to sign an acknowledgment form indicating you received the notice. This signature acknowledges receipt only—it does not mean you agree with all practices described. You still have rights to request changes or file complaints even after signing.
Key Patient Rights Listed in the Notice
Right to Access Your Medical Records
You can obtain and review copies of your medical records. The notice explains how to make this request and any associated costs.
Right to Amend Your Records
If you find inaccuracies or incomplete information, you can request amendments. The notice describes the process and timeframes.
Right to Accounting of Disclosures
You can request a list of everyone your health information was disclosed to. The notice explains the timeframe and any limitations.
Right to Request Restrictions
You can ask the provider to limit how they use and disclose your information. The notice explains that providers don't have to agree but must consider your requests.
Right to Confidential Communications
You can request alternative ways of communicating about your healthcare. The notice details how to make this request.
Right to File Complaints
If your privacy rights are violated, you can file a complaint with the provider or HHS Office for Civil Rights. The notice provides contact information.
What the Notice Doesn't Tell You
It's important to understand that the Notice of Privacy Practices has limitations:
- It describes minimum privacy protections—providers may offer stronger privacy protections
- It doesn't list every possible disclosure scenario (general categories are used)
- It may not address state privacy laws that are stronger than HIPAA
- It doesn't include specific details about technology security measures
- Providers can update their practices and must notify you of changes
What to Do If You Don't Receive a Notice
Ask the Administrative Office
Contact your healthcare provider's front desk or administrative office and request a copy of their Notice of Privacy Practices.
Check Their Website
Many providers post their Notice of Privacy Practices on their website. Look for a "Privacy Policy" or "Patient Rights" section.
File a Complaint
If the provider refuses to provide the notice, you can file a complaint with the HHS Office for Civil Rights. Providers are legally required to give you this document.
How to Review the Notice Effectively
Key Sections to Review
- The provider's contact information for privacy questions
- How the provider uses your information for treatment, payment, and operations
- Whether they disclose information for marketing purposes
- Privacy safeguards they have in place
- How long they keep your records
- Your rights and how to exercise them
- How to file complaints
Questions to Ask Yourself
- Am I comfortable with how this provider uses my information?
- Are there disclosures I don't want? (If yes, request restrictions)
- Do I want confidential communications? (If yes, submit a request)
- What's the process if I have privacy concerns?
Take Action Now
Review the Notice of Privacy Practices from your healthcare providers today. If you have questions or concerns about your privacy, contact the provider's privacy officer or file a complaint with HHS OCR.
Learn More About Your Rights