Who must receive a notice of privacy practices?
Covered entities must distribute this notice to each enrollee by April 14, 2004. Thereafter, it must be given to new enrollees at the time of enrollment, or whenever a material modification to the plan is made. Covered entities must send reminders to each enrollee at least once every three years that the privacy notice is available upon request. It is necessary to furnish the privacy notice only to the named insured, not to spouses and dependents. What must the Notice of Privacy Practices contain? The HIPAA Privacy Rule requires that the privacy notice be written in plain language and contain the uses and disclosures, with examples, of how the plan uses participants’ health information. It must advise enrollees of their right to request and receive copies of their health information and to request restrictions on certain uses and disclosures of that information. And where state privacy rules exist that are more comprehensive than the federal rule, the notice must contain the state requ
