As we enter the open enrollment season for health plans, we are reminded to review all health plan notices including, the Notice of Privacy Practices (NPP). However, this review of the NPP applies to all covered entities subject to Section 1557 (1557) of the ACA.
Those covered entities under 1557 include, in general, hospitals, health clinics, state Medicaid agencies, community health centers, physician practices, home healthcare agencies, and health insurance issuers. If an employer sponsors a self-insured health plan administered by a health insurance issuer, the self-insured health plan is also considered a covered entity.
Generally, a covered entity may not discriminate in providing health coverage based on race, color, national origin, sex, age, or disability. These ACA nondiscrimination obligations must be addressed in “Significant Publications”. The Office of Civil Rights (OCR) has previously opined that the NPP is a Significant Publication. Therefore, covered entity should verify that their NPP’s have been updated to include any nondiscrimination notice language and taglines required by 1557. These updates are not considered a material change under HIPAA, so covered entities are not required to obtain a second acknowledgment of receipt of the modified NPP. Nor, are they required to immediately replace paper copies of the NPP. If the covered entity also publishes its NPP on its website, this should also be updated.
For those that are not familiar with 1557 or need a refresher, the NPP should be updated to include the following information:
In order to satisfy the LEP requirements, the NPP must include taglines in the top 15 languages within the covered entity’s state. For small communication such as postcards, a modified nondiscrimination statement is permitted and taglines are in the top two languages.
The enforcement provisions in the final rule are fairly robust. Where noncompliance cannot be corrected with the OCR informally, available enforcement mechanisms include termination of HHS funding, referral to the Department of Justice, and any other means authorized by law. The final rules also provide that compensatory damages are available in appropriate administrative and judicial actions.
If you have questions about Notice of Privacy Practices, please contact us and a P&N professional will be ready to speak with you.