Notices of Privacy Practices: a survey of the Health Insurance Portability and Accountability Act of 1996 documents presented to patients at US hospitals

Abstract

Background: Federal regulation requires hospitals to present patients with a Notice of Privacy Practices (NPP) that contains all stipulated content items, is readable by patients, and posted on institutional web sites.

Objective: The objective of this study was to determine whether the NPP texts contain the required content, if readability is influenced by local literacy rates, and if readability or the presentation of NPP texts in other languages is influenced by local rates of English proficiency.

Research design: The authors conducted a cross-sectional study of the web sites of 115 hospitals selected from the US News and World Report list: Best Hospitals in America.

Measures: English NPP texts were evaluated for 18 content items and readability using the Flesch-Kincaid scale, which assigns the minimal grade level required to read a text (range, 0-16).

Results: NPP texts were available for all hospitals (115 of 115). A Spanish-language NPP was available for 25% (29 of 115). All content items were evident in 76% (87 of 115) of hospitals' NPP texts. The average grade-level readability of NPP text was 12.3 (95% confidence interval, 12.0-12.7). Readability was not associated with the rate of local literacy (P = 0.07). Hospitals with a lower local rate of English proficiency had NPP texts that were more difficult to read (P = 0.03) and did not present NPP texts in other languages more frequently (P = 0.15).

Conclusions: Although NPP texts typically cover the stipulated content, they are written beyond the reading capacity of the majority of American adults. Explicit federal guidance is needed to help privacy lawyers draft NPP texts that are both comprehensive and comprehensible. The goals of the Health Insurance Portability and Accountability Act of 1996 Privacy Rule cannot be met with NPP texts patients cannot decipher.