As required by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Final Rule, the Department of Health Services (DHS) is sending a Notice of Privacy Practices (NPP) to Medi-Cal recipients prior to the April 14, 2003 compliance date to inform them about Medi-Cal privacy practices and how recipients can access their health information.

The Medi-Cal NPP being sent to Medi-Cal recipients states, in part, that recipients have the right to:

• Ask DHS not to use or share recipient information;
• Ask DHS to contact them in writing only at an alternate address other than their home address, or by telephone only at an alternate number other than their home number;
• Receive a history of where their health records have been disclosed;
• Complain about violations of HIPAA privacy provisions.

In addition, Medi-Cal recipients have the right to look at, receive copies of, and amend information in their health records. Recipients are instructed in the NPP to contact their Medi-Cal providers directly to access their medical records.

The Medi-Cal NPP also will be available online at the DHCS (www.dhcs.ca.gov/Pages/default.aspx) and Medi-Cal (www.medi-cal.ca.gov) Web sites prior to the compliance date.

Covered Entity Providers

If you are a covered entity provider, you will need to ensure that Medi-Cal recipients have access to the NPP specific to your policies and procedures. For information on how to determine if you are a covered entity, go to the Centers for Medicare and Medicaid Services (CMS) Web site (www.cms.gov/hipaa) and visit the Covered Entity Decision Tools page.

Preemption Analysis

For help with analysis of HIPAA vs. State law, providers can go to the California Office of HIPAA Implementation (CalOHI) Web site (www.calohi.ca.gov). CalOHI has prepared a preemption analysis that can be found by going to the Legal Issues page.