A health care provider provides health services to the public, and also provides health services to its own employees under a self-funded group health plan.

In such instances is it recommended to maintain one notice of Privacy Practices ("NOPP") for the hospital to provide to member of the public who become patients there, and a separate notice for employees of the self-funded group health plan who are treated at the hospital or one of its clinics?

I am thinking "yes" is the answer but am not sure of any regulatory support.

Yes, the hospital and the plan are two separate covered entities. You could combine them, but i do not reccommend it. There are different issues with each and for us, it was much easier to keep them separate. We have one for patients, we have another one for our health plan (members).

Christine,

I am sorry, I did not include the regulation references. 160.103 contains the definitions for a covered entity.

(1) Except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person Covered entity means:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

164.520 contains the information regarding the Notice itself, with different requirements for providers and health plans.

Let me know if you need anything else, I will be glad to help.

Thanks for your thorough assistance.