HIPAA requires that privacy notices be issued (1) to all employees when they first become covered by the plan, (2) to any employee upon request and (3) to all employees each time the privacy policy is revised. In addition, at least once every three years (beginning three years after the notice is first provided), employees must be informed (in writing) that the notice is available and the procedure for requesting a copy of the notice or group health plans may distribute a new notice every three years.
Self-Compliance Tool for Part 7 of ERISA: HIPAA and Other Health Care Related Provisions
