§164.520(c)(2) Specific requirements for certain covered health care providers. A covered health care provider that has a direct treatment relationship with an individual must:
(i) Provide the notice:
(A) No later than the date of the first service delivery, including service delivered electronically, to such individual after the compliance date for the covered health care provider; or
(B) In an emergency treatment situation, as soon as reasonably practicable after the emergency treatment situation.
(ii) Except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt of the notice provided in accordance with paragraph (c)(2)(i) of this section, and if not obtained, document its good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained;
(iii) If the covered health care provider maintains a physical service delivery site:
(A) Have the notice available at the service delivery site for individuals to request to take with them; and
(B) Post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered health care provider to be able to read the notice.
(iv) Whenever the notice is revised, make the notice available upon request on or after the effective date of the revision and promptly comply with the requirements of paragraph (c)(2)(iii) of this section, if applicable.
Audit Inquiry
Does a covered health care provider with direct treatment relationships with individuals provide its notice of privacy practices consistent with the established performance criterion?
Obtain and review the policies and procedures in place regarding the provision of the notice of privacy practices.
Obtain and review a sample of acknowledgement of receipt of the notice and of documentation showing a good faith effort was made when an acknowledgment could not be obtained.
Has the covered health care provider provided the notice of privacy practices to individuals as required? From sample of a population of individuals who were new patients/new individuals, obtain and review documentation to determine if the initial date of service corresponded with the date of the notice of privacy practices was received. If the dates do not correspond, determine if the initial service was an emergency situation or if there was another means or explanation.
Review documentation related to provision of notice to individuals who presented for emergency treatment.