You are probably getting sick of hearing about the September 23, 2013 deadline for compliance with the HIPAA omnibus rule, as we have posted several times about this over the past six months (click here, here, or here for more information). However, given that we have been hounding employers to take action to ensure compliance by this deadline, we thought it only fair that we inform you about a development that makes compliance a bit easier.

Just a few days ago, the U.S. Department of Health & Human Services (the “HHS”) issued model Notices of Privacy Practices that health care providers and health plans can use to inform patients and plan participants of the entity’s privacy practices. Apparently, the HHS believes that employers like options, because the notices come in four different forms:

  • Notice in the form of a booklet;
  • A layered notice that presents a summary of the information on the first page, followed by the full content on the following pages;
  • A notice with the design elements found in the booklet, but formatted for full page presentation; and
  • A text only version of the layered notice.


Each of the model notices reflects the changes mandated under the HIPAA omnibus rule. Plan sponsors simply need to enter their specific information into the model and then distribute the notice in accordance with the following HIPAA distribution rules.

  • Employers that generally post the notice to their website must (1) post the revised notice by 9/23/2013 and (2) provide the revised notice, or information about the material change and how to obtain the revised notice, in the next annual mailing to covered individuals (i.e., during open enrollment).
  • Employers who do not post the notice to their website must distribute the revised notice (or information about the changes and how to obtain the revised notice) to individuals then covered by the plan within 60 days of the material revision to the notice.

So, if you are a last-minute type of person like so many of us are (including the HHS with respect to its issuance of these model notices), you now have an easy option for complying with at least one of the requirements stemming from the HIPAA omnibus rule.