HIPAA Notice of Privacy Practices (NPP)
HIPAA; 45 CFR § 164.520
Self-insured health plans must maintain and distribute a Notice of Privacy Practices describing how PHI is used and disclosed, individual rights, and plan duties. Fully insured plans: carrier provides the NPP.
What does NPP stand for in HIPAA?
Notice of Privacy Practices. It's the document that tells plan members how their protected health information (PHI) gets used and disclosed, what rights they have over it, and what duties the plan carries. Every HIPAA-covered health plan has to have one.
Fully insured vs. self-funded: who owes the notice?
Fully insured: the carrier maintains and distributes the NPP, and an employer that only touches enrollment data has minimal duties. Self-funded: the plan itself is the covered entity, so the employer's plan must maintain its own NPP and distribute it. Switching from fully insured to self-funded quietly adds this to your list. Most first-year self-funders miss it.
When it has to go out
- To every new enrollee at enrollment.
- Within 60 days of any material revision.
- At least every 3 years, remind members the notice exists and how to get it. The reminder can ride along with open enrollment materials.
- Any time someone asks.
HHS publishes model notices you can adapt. Don't write one from scratch.
Related Reading
Track this and 71 other federal requirements. Personalized to your plan.