Countdown to HIPAA

Preparing your privacy notice

As this issue of Drug Topics arrives, pharmacies have about one month until the April 14 deadline to distribute their "Notice of Privacy Practices" (NOPP). This column calls attention to the importance of a properly prepared NOPP and provides an overview of the NOPP content requirements. Those responsible for a pharmacy's compliance with HIPAA, the Health Insurance Portability & Accountability Act, must understand these content requirements and the need to provide the NOPP to patients and others.

Why is the NOPP so important?

The purpose of the NOPP is just what its name implies: to provide notice. It is through the NOPP that the pharmacy gives patients and others notice as to the matters covered in the document. Thus, the content included in the NOPP becomes crucial to effective implementation of the HIPAA privacy standards and protecting the pharmacy from claims of unauthorized use or disclosure of protected health information (PHI). Related to this and if the need arises, it is essential that the pharmacy be able to produce the patient's written acknowledgment (signature) of receipt of the NOPP, or, as an alternative, documentation of the pharmacy's good-faith effort to obtain the written acknowledgment.

fAn example will demonstrate the importance of the NOPP. Likely every community pharmacy has encountered a patient attempting to obtain controlled substances from multiple prescribers, or a patient attempting to have a fraudulent prescription dispensed. Typically this is discovered when the pharmacist contacts the prescriber and discloses information about the Rx and the patient. Upon being confronted, the patient may accuse the pharmacist of breaching confidentiality by the disclosure to the prescriber, and even threaten a lawsuit.

To protect against such claims, the NOPP must state that the pharmacy will use and disclose PHI pursuant to treatment, and may include as an example of such a disclosure that the pharmacy will contact prescribers to resolve questions about Rxs and drug-related problems found with prospective drug use review.

What to include in the NOPP?

The NOPP must describe the pharmacy's uses and disclosures of PHI and its legal duties with respect to PHI, and the patient's rights. The NOPP must be in plain language and contain the following information:

• As a header, or otherwise prominently displayed, the following statement:

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

• A description, with at least one example, of the uses and disclosures the pharmacy is permitted to make for treatment, payment, and healthcare operations.

• A description of other purposes (as provided by HIPAA) for which the pharmacy is permitted or required to use or disclose PHI.

• A statement, with at least one example, of the pharmacy's products and services (e.g., refill reminders, alternative treatments), if you plan to engage in such patient contact.

• A statement of the patient's rights with respect to PHI and a brief description of how to exercise these rights:

–The right to request restrictions on certain uses and disclosures of PHI, including a statement that the pharmacy is not required to agree to a requested restriction.

–The right to receive confidential communications of PHI, as applicable.

–The right to inspect and copy PHI.

–The right to amend PHI.

–The right to receive an accounting of disclosures of PHI.

–The right of a patient, including one who has agreed to receive the NOPP electronically, to obtain a paper copy of the NOPP.

• A description of the pharmacy's duties, including:

–A statement that the pharmacy is required by law to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy practices with respect to PHI.

–A statement that the pharmacy is required to abide by the terms of its notice.

–For the pharmacy to apply a change in a privacy practice that is described in the notice to PHI that the pharmacy created or received prior to issuing a revised notice, a statement that it reserves the right to change the terms of its notice and to make the new notice provisions effective for all PHI that it maintains. The statement must also describe how it will provide individuals with a revised notice.

• A statement that patients and others may complain to the pharmacy and to Health & Human Services if they believe their privacy rights have been violated, a brief description of how to file a complaint with the pharmacy, and a statement that those who file a complaint will not be retaliated against by the pharmacy.

• A statement of the name, or title, and telephone number of a person or office to contact for further information.

• The date on which the notice is first in effect, which may not be earlier than the date on which the notice is printed or otherwise published.

Several examples of NOPPs and detailed information about how to prepare the NOPP are available in various HIPAA resources. Those responsible for developing a pharmacy's NOPP are encouraged to utilize these resources.

By Walter L. Fitzgerald Jr., R.Ph., J.D.

The author, a pharmacist-attorney, is a professor of pharmacy at the University of Tennessee College of Pharmacy and author of the NCPA HIPAA Compliance Handbook for Independent Pharmacy. To access the NCPA Web site, go to: www.ncpanet.org.

 

Walter Fitzgerald. Countdown to HIPAA: Preparing your privacy notice. Drug Topics 2003;6:52.