The notice of privacy practices: who must give one and how often.
Most health plans must give covered individuals a notice that explains how their information is used and what rights they have. A fully insured plan with limited involvement may be exempt, and a self-funded plan generally is not.
Who, when and what.
Most Plans Must Provide One
HHS says most covered entities must develop and provide the notice. Group health plans that provide benefits only through insurance, and receive only summary, enrollment or disenrollment information, are an exception. For an insured plan, the carrier often prepares and sends the notice, while a self-funded plan may handle it directly. Employers should confirm who does what and keep a copy of the current version.
New Enrollees And Revisions
New enrollees receive the notice at enrollment. A material revision requires a revised notice to covered individuals within 60 days. HR teams should add the notice to the enrollment packet and set a process for sending revisions, with a simple log showing when and how each version went out.
The Three-Year Reminder
At least once every three years, the plan must tell covered individuals the notice is available and how to get it. The reminder can be built into open enrollment or another regular mailing. Employers should write the task into the compliance calendar and keep proof of the date it was sent.
What It Must Say
In plain language: how information may be used and disclosed, the individual’s rights and how to complain, the plan’s legal duties, a contact, and an effective date. Employers should compare the notice to the plan’s actual practices and ask the carrier or counsel to confirm that the language is current, complete and written clearly for employees.
What the notice must contain and when plans give it out.
Required Content
The notice needs a prominent header, how information is used and disclosed, the individual’s rights, the entity’s duties, how to complain with a no retaliation statement, a contact person or office, and an effective date. Employers can ask the carrier or counsel for a checklist to compare against the notice, then record the review date, so any gap can be fixed before the next enrollment period.
Individual Rights Listed
The rights to request restrictions and confidential communications, to inspect and copy, to amend, to get an accounting of disclosures, and to get a paper copy. The notice should explain how to make each request, who to contact and how long the plan has to respond. Employers should check that the contact details are current.
New Enrollees
A health plan gives the notice to new enrollees at the time of enrollment. Employers should add the notice to onboarding and enrollment packets, confirm the carrier provides it, and keep a record of when new enrollees receive it, whether on paper or electronically.
Every Three Years
At least once every three years the plan must tell covered individuals that the notice is available and how to get it. Employers can include the reminder with open enrollment or other regular mailings, and should keep the date and method on file in case anyone asks later how it was handled.
Material Changes
A plan that does not post the notice online must give the revised notice, or information about the change, within 60 days of the revision. A plan that posts online posts the change by its effective date. Employers should ask the carrier or counsel which delivery method applies to their plan and when the revised notice is due, then record the date and method used for the file.
Website And Email
A plan with a website describing its benefits must post the notice there. Email delivery is allowed if the individual agrees, and a paper copy is still available on request. Employers who maintain a benefits website should check that the notice is easy to find and kept current, and confirm with counsel or the carrier whether electronic delivery fits the plan’s practices.
Source: 45 CFR 164.520.
Keeping the notice current.
Decide If You Are Exempt
Confirm what information your fully insured plan really receives. If it is more than summary and enrollment information, the exemption may not apply. A fully insured plan’s duties can differ from those of a self-funded plan, so ask the carrier and counsel to confirm what information the plan receives and which obligations follow from that.
Post It Where Employees Look
If your website provides information about benefits, HHS says the notice must be prominently posted there. Check the benefits page on your website and the employee portal, and make sure the link is working and the version is the current one. Keep a dated record of the check.
Calendar The Reminder
Set a date every three years for the availability reminder, and a trigger for revisions. Add the reminder and revision triggers to the compliance calendar with an owner and a backup, and keep a copy of each reminder sent so the file is complete if questions arise.
Check Recent Updates
HHS says remaining changes to the notice requirements from the 2024 reproductive health rule had a compliance date of February 16, 2026. Make sure your notice reflects them. Because this area has changed, ask counsel which updates apply to the plan’s notice today and confirm that the version in use matches. Keep a dated copy of the review with plan records.
Three questions for the plan.
Who Issues The Notice
For an insured plan, the carrier usually issues its own. A self-funded plan issues the employer plan’s notice. Confirm in writing who prepares, updates and distributes the notice for your plan, and keep a copy of the version in use so the answer is easy to find at renewal.
When Was It Last Reviewed
If the date is old, check it against current requirements. Write down the date of the last review, who reviewed it and what changed. If the date is old, ask counsel or the carrier to review it against current requirements.
Can We Show We Distributed It
Keep copies and records of distribution for the required retention period. Create a simple folder with each notice version, the date and method of distribution and the list of recipients, and ask counsel to confirm how long the plan should keep it.
Common Questions About The Notice Of Privacy Practices
Does our fully insured plan need a notice?
Not if it provides benefits only through insurance and receives only summary health information and enrollment or disenrollment information. The carrier still has its own duty.
How often must it be sent?
To new enrollees at enrollment, within 60 days of a material revision, and with a reminder of availability at least every three years.
Can we put it on our website?
If you maintain a site with information about benefits, HHS says the notice must be prominently posted there. It does not replace the required distribution.
Who signs for it?
Health plans are not required to collect an acknowledgment. That requirement is aimed at providers with a direct treatment relationship.
Did the notice requirements change recently?
HHS says the reproductive health privacy rule was largely vacated, but remaining notice changes had a compliance date of February 16, 2026.
Is this legal advice?
No. For your own plan, involve your counsel. We can help you work out which notice applies.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 164.520 — Notice of privacy practices.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.