New Models for Privacy Notices Released

Just in time to meet the Sept. 23 revised HIPAA privacy rule deadline, two HHS offices have jointly developed model notices of privacy practices that healthcare organizations can use to better communicate with their patients or plan members.

The Office for Civil Rights and the Office of the National Coordinator for Health Information Technology released the models in response to an industry request for additional guidance on how to create clear, accessible notices that would help improve patient experience and understanding, according to HHS.

While the models offer different methods in which healthcare organizations can present their privacy practices, they all contain the information specified in the regulatory changes of the Omnibus Rule and can serve as the baseline for covered entities working to come into compliance with the new requirements. For example, they all highlight the new patient right to access their electronic information held in an EHR if the provider has an EHR system.

The models, which are available in separate versions for both providers and payers, are based on the results of focus groups the offices conducted with consumers to explore the specific information they are most interested in seeing, as well as the method in which they wanted it presented. They are offered in fillable Adobe PDF designs in booklet, layered, full-page and text-only formats.

The offices found that consumers in the focus groups liked the booklet version because it was approachable, easy to read and portable. They also found that consumers liked the layered version — which presents a summary of the information on the first page, followed by the full content on the following pages — because they liked the quick and easy-to-read summary. The offices also found that consumers liked the information presented in color, as well as having access to it in both the waiting room and exam room.

Each of the designs has some areas that enable healthcare organizations to customize the notice of privacy practices for their individual entity. For example, organizations can add a logo or include other special notes.

But the offices recommend using the language and designs of the notices as they have been originally presented because of their acceptance in the focus groups.

To access the model notices or for more detailed information on how to use them, go to