Does the NPRM address notices of privacy practices (NPPs)?
Yes, there are important changes. The proposed modifications would require that all NPPs include a statement that describes the uses and disclosures of PHI that require an authorization under §164.508(a)(2) through (a)(4), and to provide that other uses and disclosures not described in the notice will be made only with the individual’s authorization. HHS explains that “[t]he proposed provision would ensure that covered entities provide notice to individuals indicating that most disclosures of protected health information for which the covered entity receives remuneration would require the authorization of the individual. Such uses and disclosures may have previously been permitted under other provisions of the Rule but now require authorization.” The changes would also require that covered entities provide notice that most uses and disclosures of psychotherapy notes and for marketing purposes require an authorization. Further, a covered entity that intends to send treatment communicati
