PRIVACY NOTICE GUIDANCE - HIPAA

---

Under the HIPAA Privacy Rule, a Notice of Privacy Practices must be given to each individual receiving medical services delivered by LSUHSC-NO. Generally, this notice will be provided to each patient the first time they are seen in a LSUHCSD hospital or LSUHSC-NO clinic. At times, however, the first contact may be with a LSUHSC-NO investigator conducting a research study that comes under the HIPAA Privacy Rule. Because of this, the LSUHSC-NO Office of Compliance Programs now requires that a LSUHSC-NO Notice of Privacy Practices be given to subjects enrolled into all studies involving treatment. This includes studies conducted at LSUHSC-NO facilities as-well-as affiliated public and private hospitals. It must be provided to the subject despite the fact that private facilities have their own Notice of Privacy Practices.

A record must be kept of either providing this document to the subject or that an attempt was made to provide it to them. Even though they should be asked to do so, the subject does not have to acknowledge receipt. A Privacy Notice Acknowledgement form signed by the subject or signed by a study team member if the subject does not want to sign must be kept by the investigator for each subject.

Note that random compliance audits are conducted by the Office of Compliance Programs and the IRB. In addition to the informed consent and Authorization documents, Privacy Notice Acknowledgements will is a subject of these audits. Investigators will also be monitored for use of the Notice of Privacy Practices and maintenance of Acknowledgement records at the time of application to the IRB for re-approval of their study.