The organization ensures that all patients with whom it has a direct treatment relationship are provided with a Notice of Privacy Practices at the first point of service delivery. In emergency situations, the notice is provided as soon as reasonably practicable after the emergency treatment.
The organization must make a good faith effort to obtain a written acknowledgment of receipt from the patient. The Notice of Privacy Practices must be available in a physical format at every service delivery site and prominently displayed in a public area.
For organizations that maintain a website providing information about their services or benefits, the Notice of Privacy Practices must be prominently posted on the website and made available electronically through it.
If the organization chooses to provide the notice electronically via email, it must first obtain the individual's agreement to receive an electronic notice. Should the email delivery fail, the organization is required to provide a paper copy of the notice. All individuals retain the right to request and receive a paper copy of the notice at any time.
