The Notice of Privacy Practices describes which of the following?

• A. The process of scheduling appointments
• B. The facility's cafeteria hours
• C. How the Privacy Rule allows use and disclosure of PHI and when authorization is needed; the organization's duties to protect privacy
• D. The patient's medical history

Answer: (C)

The Notice of Privacy Practices explains how protected health information (PHI) may be used and disclosed under the Privacy Rule, when patient authorization is needed, and the organization’s duties to protect privacy. This document tells patients what kinds of uses and disclosures are allowed without authorization, what requires authorization, and how the entity will safeguard PHI and respond to privacy concerns. It also often covers patient rights and how to file complaints.

Scheduling appointments or cafeteria hours aren’t the subjects of the NPP, and while a patient’s medical history is PHI, the NPP focuses on the rules for use and disclosure and the protections in place, not the historical details of a patient’s health record.