Answer: Before the first treatment of a patient, providers must present the notice before services are performed except in emergency situations. Patients must sign a written acknowledgement that they have received the notice of privacy practices. In emergency situations, providers are still required to attempt to provide the notice and have the patient sign the written acknowledgement.
Providers are not required to provide the notice of privacy practices each time a patient presents for treatment. HIPAA only requires a notice to be provided to patients once every three years or whenever changes are made to the notice.
The best way to make sure all of your patients are properly notified of their privacy rights are to post the notice in a highly visible location and have copies readily available for patients upon request.