ADA PRACTICAL GUIDE TO HIPAA COMPLIANCE

A. Notice of Privacy Practices

Applies to: All covered entity dental practices.

ADA Practical Guide to HIPAA Compliance Privacy and Security Manual Section:
Chapter 2, Step 3

Background: HIPAA requires dental practices to provide patients with Notices of Privacy
Practices (“NPPs”) that explain how the dental practice may use and disclose patient
information and some of the rights that patients have to control their information.

New rule: The new rule changes the content that must be included in the NPP. The new
requirements are included in the sample NPP in Appendix 2.3.1 Here is an outline of some
of the new provisions that must be in the NPP;

Authorization forms. Under the new rule, the NPP must contain information about patient
authorization forms (Chapter 2, Step 9). The revised NPP must:

+ describe the types of uses and disclosures that require a patient to sign an
authorization form,

+ contain a statement that other uses and disclosures not described in the NPP will be
made only with the patient's written authorization, and

+ contain a statement that the patient may revoke an authorization at any time, as long
as the patient does so in writing, but:

o if the dental practice has already relied on the authorization to use or disclose
patient information the revocation cannot apply to those uses or disclosures, and

o if the authorization was for purposes of obtaining insurance coverage, other law
gives the insurance company certain rights.

Fundraising. If the dental practice plans to use patient information in order to raise funds for
the practice (see “Fundraising*), the NPP must include a statement telling patients that the
dental practice may contact them for fundraising, and that patients have the right to opt out
of fundraising communications. The NPP may describe the mechanism for opting out, but this
is optional. If the dental practice does not plan such fundraising activities, the NPP does not
need to have this provision (however, the NPP would need to be revised if the dental practice
plans to begin fundraising).

Restricted disclosure to a health plan. A dental practice needs to change the statement

in the NPP about a patient's right to ask for a restriction on uses and disclosures of their
information. Under the prior rule, the statement said that the dental practice had the final say
when a patient asked the dental practice not to use or disclose the patient's information in a
certain way. Under the new rule, the NPP must state that the dental practice does not have
to agree if a patiant asks the dental practice not to use or disclose the patient's information
in a certain way, except if the following two criteria are met:

- if the patient asks the dental practice not to disclose information about a health care
item or service to a health plan for payment or health care operations purposes, and

- the dental practice has been paid in full for the item or service by the patient or by
another on behalf of the patient.

For example, if a patient pays cash for new dentures and asks the dental practice not to
submit a claim to the patient's dental plan, the dental practice must comply with the
patient's request.

Breach notification. The dental practice must state in the NPP that the practice is required
by law to notify affected individuals following a breach of unsecured patient information.

Marketing and sale of PHI. A dental practice's NPP must be changed to advise patients
that the practice cannot sell patient information without the patient's express written
authorization, and that authorization is also required for certain marketing communications,

Psychotherapy notes. Most dental practices will not record or maintain psychotherapy
notes. However, if the practice does $0. the NPP must include a statement about special
authorization requirement for uses and disclosure of psychotherapy notes,

ACTION STEPS:

- Review existing NPP.

- Revise to comply with the new rule, and with any changes in privacy
practices.

- Have NPP forms accessible to LEP and disabled patients, as applicable.

- Effective date of revised NPP must be no later than September 13, 2013.

- By the effective date of the revised NPP:

  *post the revised NPP in a clear and prominent location in the
dental office,

  *have copies of the revised NPP available for any patients who
ask for a copy, and

  *if the dental practice has a website, replace the prior NPP with
the revised NPP.

- Re-train staff to distribute revised NPP to first-time patients at their first
appointment, and ask patients to sign an acknowledgment of receipt.

- Continue retaining a Paper or electronic copy of the prior NPP for at least
six years from the date when it last was in effect.