Skip to content
English - United States
  • There are no suggestions because the search field is empty.

HIPAA Notice of Privacy Practices

Describes how the plan uses and discloses PHI and participants' privacy rights. Distribute at enrollment, within 60 days of material changes, and remind of availability every 3 years.

Companies Eligible

Self-funded and level-funded medical plans, HRAs, health FSAs, and EAPs that provide medical care. Fully insured plans only when the employer handles PHI.

A fully insured plan where the employer sees nothing beyond enrollment and summary information is “hands-off”: the carrier issues the notice and the employer's only duties are not to retaliate or require waivers of rights. An insured plan where the employer receives PHI must issue its own notice.

What it is

The notice describes how the plan uses and discloses protected health information, the participant's rights (access, amendment, an accounting of disclosures, restrictions), how to complain, and the plan's privacy contact. Since February 16, 2026 it must also carry the 42 CFR Part 2 statements on substance-use-disorder records — confirm the template in use is the post-February-2026 version.

What needs to be done

  • When: To new enrollees at enrollment; within 60 days of a material change (a plan that posts its notice on a website posts the revision by the effective date and includes it in the next annual mailing); and a reminder that the notice is available at least once every 3 years — one sentence in the OE materials satisfies the reminder.
  • To whom: Named insureds; one notice per household covers dependents.
  • Who performs: The plan sponsor's privacy official for self-funded plans; the carrier for hands-off insured plans.
  • Customize: Plan name, effective date, privacy official name and contact, complaint contact, and any state-specific rights.
  • Deliver: Paper, or electronic where the individual has agreed to electronic notice. Posting on the plan's website is in addition to, not instead of, delivery.
  • Keep: Each dated version, the distribution record, and the date of the last 3-year reminder.

Download