Just when you think you have heard it all, HIPAA has a requirement that plan sponsors must send a notice to participants letting them know they have a right to receive a notice of privacy practices. But first, let’s take a step back. HIPAA requires that group health plans distribute a notice of privacy practices to all newly eligible participants in the health plan. If your plan is fully-insured, the insurer is likely handling this notice. If your health plan is self-funded, the responsibility generally falls to the plan sponsor. HIPAA also requires that a new notice be sent within 60 days of a material change to the notice. Due to the issuance of final regulations several years ago, all plans were required to send an updated notice by November 23, 2013 to be in compliance with the regulations.
Plan sponsors are also required to send a notice of availability to all participants once every 3 years. This notice of availability is just a reminder to participants that they have a right to request a notice free of charge and the contact information for who to request one from. The notice of availability can be included with other materials (e.g., some employers put the notice as a pay check stuffer) and may be able to be sent electronically. Since all group health plans were required to revise their notices by November 23, 2013 to comply with the final omnibus HIPAA regulations, the 3 –year deadline for reminding participants is approaching for all plans that have not sent a revised notice or notice of availability since the deadline in 2013.