HIPAA Notice of Privacy Practices Distribution Reminder


The Health Portability and Accountability Act (HIPAA) Privacy Rule requires group health plans to notify individuals at least once every three years of the availability of the Privacy Notice and how to obtain it. The Privacy Rule provides that an individual has a right to notice of how a covered entity uses and discloses protected health information (PHI) about the individual and the individual’s rights with respect to his or her PHI. The requirement applies to medical, dental, prescription drug and vision health plans, as well as Section 125 health flexible spending accounts.

Large group health plans (more than $5 million in claims paid) had to distribute the Privacy Notice no later than April 14, 2003 (April 14, 2004, for small health plans). In addition, the Privacy Notice must be provided:

  1. To new enrollees at the time of enrollment
  2. Within 60 days of a material change to the notice
  3. Any time upon a participant’s request

Most health plans satisfy this requirement by annually distributing the Privacy Notice alongside the summary plan description. If the Privacy Notice was not sent out annually, then large health plans must send the Notice by April 14, 2012 (small plans have until April 14, 2013). To easily comply with the distribution requirement, it is recommended group health plans deliver the Privacy Notice to participants every year.

Click here for the sample HIPPA Privacy Notice.


If you have any questions regarding the HIPAA Privacy Notice and its distribution requirements, please contact your team at WGA.