Joint NPP service-site scope description

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Entity and site scope answer different questions

45 CFR 164.520 requires both descriptions. A participating entity may operate locations outside the OHCA, and a shared campus may include organizations outside the joint notice. Map each site to the exact participant and arrangement.

Create a site register with legal location name, public name, address or setting, service type, participant entity, OHCA basis, PHI scope, opening and closure dates, current joint notice, separate-notice exceptions, delivery owner, posting owner, website route, and accountable contact. A location belongs in scope because verified arrangement facts support it, not because it uses the shared brand.

Define physical and nontraditional settings

For a physical clinic, identify entrances, reception or service paths, participating departments, co-located entities, hours, posting locations, take-away copies, and first-service workflow. Shared campuses and medical buildings require extra clarity because a reader may encounter participants and nonparticipants in the same place.

Home, school, community, mobile, temporary, and telehealth services need a documented setting rule. Identify which participant provides the service, where PHI is created or received, how the notice is delivered and available, and whether the joint arrangement covers that activity. Avoid forcing a street-address model onto a service whose meaningful scope is program or virtual platform.

Site classes need testable criteria

A class such as “participating outpatient clinics listed at this address” needs a maintained list and working public route. Define how openings, closures, relocations, home and community services, telehealth, and temporary locations affect the notice.

Use objective class criteria and a dated public list where helpful. Test whether an unfamiliar reader can determine if a named location or service is included. Keep the public route available without unnecessary authentication, and archive prior lists for historical questions. The internal register should explain every inclusion and exclusion.

Coordinate notice operations at each site

For in-scope sites, assign physical posting, website or page mapping, first-service and emergency delivery, acknowledgment effort, paper requests, language and accessibility support, complaints, rights requests, and incident escalation. Confirm that local staff can retrieve delivery evidence from another participant when single-participant provision is relied on.

Review public signage and staff scripts for clarity about entities outside the joint scope. A contractor or separate practice may share a reception desk without using the joint notice. Route people to the correct notice rather than distributing the joint copy as a universal campus document.

Govern openings, moves, and closures

Make privacy scope a required gate in site-launch and telehealth-launch checklists. Complete participant and OHCA review, notice assignment, staff training, posting, copy stock, electronic route, and delivery tests before opening. For relocation or closure, set effective dates, remove current public references, preserve historical evidence, and determine the notice for continuing services and stored records.

Inspect after construction, temporary moves, acquisitions, brand changes, or new service lines. Reconcile facilities, licensing, scheduling, website, and participant records to find locations missing from the privacy register.

Example with location review

Twenty-two locations reach review. Twenty map to a named class, one recently closed, and one new telehealth program lacks a scope decision. Current mapping is 20 of 22 locations. Keep both unresolved locations visible until the register and notice are updated.

The owner dates and archives the closed site's participation, removes current listings, and preserves historical delivery evidence. The telehealth program remains on a launch hold until its entity, arrangement, PHI, delivery, and rights-routing facts are approved. The original 20-of-22 result stays visible.

Site-scope checklist

• Map each setting to a participant, OHCA basis, and effective period.
• Distinguish participants from co-located or contracted organizations.
• Define physical, mobile, home, school, temporary, and virtual sites.
• Assign posting, delivery, paper, rights, complaint, and incident duties.
• Give readers a current, usable way to confirm included sites.
• Gate openings, moves, closures, and service changes on scope review.
• Audit operational locations against the dated privacy register.

Owner controls

The HHS notice guidance supports general implementation. Maintain site identity, address or setting, entity owner, OHCA role, dates, notice posting, electronic access, class criteria, change trigger, and verification evidence.

Monitor sites mapped, launches approved, posting and copies current, delivery tests passed, public lists aligned, scope exceptions, and closure actions. Audit from the register into real settings and from scheduled services back to valid site and participant scope. Preserve historical site versions and corrections.

Record the inspector, date, evidence, finding, correction owner, and follow-up result for every sampled setting.