For anyone still struggling to revise its HIPAA Notice of Privacy Practices, the U.S. Department of Health and Human Services has made a model notice available. The model may be found here.
Government regulations issued on January 25, 2013 contained provisions which must be reflected in a revised Notice of Privacy Practices. Under those regulations, a health plan that posts its Notice of Privacy Practices on its web site had to prominently post the revised notice on its web site by September 23, 2013, and also must provide the revised notice, or information about the revisions and how to obtain the revised notice, in its next annual mailing to individuals covered by the plan. Any other health plan must provide the revised Notice of Privacy Practices to covered individuals within 60 days after September 23, 2013.