The HIPAA Privacy Rule requires health plans and covered health care providers to develop and distribute Notices of Privacy Practices (NPPs). The Notice of Privacy Practices must be given to patients. The notice must describe how the covered entity (CE) may and may not use protected health information (PHI), and what the patient’s rights and obligations with respect to the PHI are.
hipaa privacy notice
Covered entities that must develop a HIPAA Notice of Privacy Practices are defined as 1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with a HIPAA-related transaction. PHI is individually identifiable health information held or transmitted by a covered entity, in any form or medium, whether electronic, on paper, or oral.