| name | hipaa-privacy-notice |
| title | Notice of Privacy Practices (HIPAA) |
| description | Drafts a HIPAA-compliant Notice of Privacy Practices per 45 CFR § 164.520 for covered entities. Produces patient-accessible documents covering permitted PHI uses/disclosures, individual rights, breach notification, and complaint procedures. Use when drafting HIPAA privacy notices, NPP documents, patient privacy disclosures, or covered entity privacy practice notices. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/hipaa-privacy-notice |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | healthcare |
| language | en |
Notice of Privacy Practices (HIPAA)
Drafts a complete Notice of Privacy Practices satisfying 45 CFR § 164.520, ready for legal review and patient distribution.
Prerequisites
Collect before drafting:
- Covered entity details — legal name, business address, effective date
- Privacy Officer contact — name, title, phone, email, mailing address
- Entity-specific practices — facility directories, fundraising, marketing (if applicable)
- Fee schedule — charges for PHI copies, if any
- State law overlay — state privacy requirements more stringent than HIPAA
Quick Start
- Gather prerequisites above
- Draft each section in order (see Document Sections below)
- Write at or below 8th-grade reading level throughout
- Run through the Checks section before delivering
Document Sections
1. Header & Introduction
Include: entity legal name, primary business address, effective date, purpose statement ("how your medical information may be used and disclosed").
2. Legal Duties (§ 164.520(b)(1)(v))
State entity is required by law to:
- Maintain privacy of PHI
- Provide this notice of duties and privacy practices
- Follow the notice currently in effect
- Notify individuals following a breach of unsecured PHI
3. Permitted Uses & Disclosures Without Authorization
Draft concrete, patient-readable examples for each:
| Category | Scope | Example |
|---|
| Treatment | Care coordination, referrals | Sharing records with a specialist |
| Payment | Billing, claims, utilization review | Submitting claims to insurance |
| Healthcare Operations | Quality, training, planning | Internal audits, staff training |
| Required by Law | Court orders, public health | Reporting communicable diseases |
| Public Interest | Abuse/neglect, FDA, workers' comp | Reporting suspected child abuse |
4. Conditional/Optional Disclosures
Include only if applicable; state opt-out right for each:
- Facility directory (name, location, general condition, religious affiliation)
