HIPAA privacy notice: Can I leave off the plan names?

[Guest cstrong]

As an employer with many plans (it has already been determined that the plans are "affiliated entities" and members of an "organized health care arrangement"), does the privacy notice for the plans have to list the specific plan names? I have reviewed the regs and there doesn't appear to be a specific requirement to list the plan names.

Thanks for any guidance!

[Jbentz]

I know we were required to do this for our ACE and OHCA, so I did a search of the regs. I found under 164.520

"(d) Implementation specifications: joint notice by separate covered entities. Covered entities that participate in organized health care arrangements may comply with this section by a joint notice, provided that:

(1) The covered entities participating in the organized health care arrangement agree to abide by the terms of the notice with respect to protected health information created or received by the covered entity as part of its participation in the organized health care arrangement;

(2) The joint notice meets the implementation specifications in paragraph (b) of this section, except that the statements required by this section may be altered to reflect the fact that the notice covers more than one covered entity; and

(i) Describes with reasonable specificity the covered entities, or class of entities, to which the joint notice applies;

(ii) Describes with reasonable specificity the service delivery sites, or classes of service delivery sites, to which the joint notice applies; and

(iii) If applicable, states that the covered entities participating in the organized health care arrangement will share protected health information with each other, as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement.

So yes, I think yit is required.