The article “HIPAA Again: Confronting the Updated Privacy and Security Rules” [May/June 2013] mistakenly said the new HIPAA (Health Insurance and Portability and Accountability Act) rules require practices to alert patients in their Notice of Privacy Practices (NPP) if they send automated appointment reminders or communications about treatment alternatives or health-related benefits. In fact, if a practice receives remuneration from patients for sending such communications, it has to get an authorization from the patient to do so. But there is no requirement that these communications be included in the NPP. Also, the article mistakenly said practices must include in the NPP new liabilities associated with business associates under the updated HIPAA rules. This is also not necessary.
WE WANT TO HEAR FROM YOU
Send your comments to fpmedit@aafp.org. Submission of a letter will be construed as granting AAFP permission to publish the letter in any of its publications in any form. We cannot respond to all letters we receive. Those chosen for publication will be edited for length and style.
