Notice of Privacy Practices

This is a staging review draft. It has not been approved as the practice’s effective policy or notice.

This document is a working draft and is not yet in force. A Notice of Privacy Practices has content mandated by 45 CFR §164.520, and getting it wrong is a compliance matter rather than a copywriting one. It must be reviewed and finalised by the practice's HIPAA compliance officer or attorney before publication, and the effective date below must be set at that point.

What this notice must cover

The header language required verbatim by §164.520(b)(1)(i)
Uses and disclosures for treatment, payment and health care operations, with an example of each
Uses and disclosures requiring your written authorisation, and your right to revoke it
Disclosures permitted or required without authorisation, including public health and law enforcement
Your rights: access, amendment, an accounting of disclosures, restriction requests, confidential communications, and a paper copy of this notice
The practice's duties, including the duty to notify you following a breach
How to complain to the practice and to the Secretary of Health and Human Services, and that you will not be retaliated against for doing so
A named contact and the effective date

Contact

Privacy Officer, Dentista, 740 Bridge Street NW, Grand Rapids, MI 49504. Telephone [telephone pending approval].

Michigan has its own record-retention and minor-consent provisions that sit alongside HIPAA. Those need checking against current state law before this notice is finalised.