Triennial NPP availability notice

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The cohort is people currently covered

Current 45 CFR 164.520 requires the health plan to notify individuals then covered no less frequently than once every three years. Lock the cohort at a defined date and preserve enrollment evidence, notice version, obtainment instructions, send date, route, and failures.

Build the cohort from current coverage records using a documented as-of date, plan product, individual identity, and notice relationship. Reconcile additions, terminations, retroactive changes, and duplicate identifiers without silently changing the denominator after launch. Preserve query logic and source counts.

The communication tells covered individuals that the NPP is available and how to obtain it. Use current contact routes, descriptive instructions, and a working link or request method. Keep this reminder separate from new-enrollee distribution and material-revision duties.

Dependent and notice rules still need mapping

The rule includes named-insured and relevant-notice provisions. Plan design, multiple notices, coverage structure, electronic consent, mailing, and governing documents can affect implementation. Keep the reminder distinct from new-enrollee delivery and material-revision distribution.

Map subscribers, dependents, personal representatives, multiple benefit packages, electronic agreement, confidential communication, and paper routes under the plan's current legal analysis. Avoid broad assumptions that one household message always satisfies every individual relationship.

Deliver and reconcile the locked cohort

Assign one outcome per cohort member: sent, delivered where supported, failed, returned, suppressed for reviewed reason, duplicate resolved, or still open. Apply safe fallback and confidential-contact controls. Reconcile vendor input, output, failures, retries, and final totals.

Maintain a three-year compliance calendar with owner, last cycle, next due date, legal review, content approval, and evidence retention. Test the obtainment route during the entire cycle, not only on send day.

Example with a locked cohort

A plan locks 240 covered individuals for its reminder. Messages reach 226, while 14 fail and remain assigned. Documented delivery is 226 of 240, or 94.2%. The failures remain in the original cohort.

If eight failures are resolved by paper and six remain unsafe or undeliverable, the final report shows 234 completed and six open. Do not remove failures from the denominator. Preserve each fallback and exception decision.

Triennial checklist

• Set the three-year calendar and documented cohort as-of date.
• Build and retain current-coverage query logic and reconciliation.
• Approve reminder content and a working obtainment route.
• Apply subscriber, dependent, representative, and notice rules.
• Respect confidential communication and electronic preferences.
• Reconcile vendor sends, failures, returns, retries, and paper fallback.
• Preserve the fixed denominator, evidence, and next-cycle owner.

Owner controls

HHS guidance describes the three-year reminder. Use a calendar owner, locked cohort, approved text, current link or request route, address hygiene, failure retries, vendor reconciliation, and evidence retention.

Monitor cohort completeness, route quality, failure age, obtainment-link uptime, and overdue cycles. Audit from coverage records into the cohort and from sent records back to current coverage. Re-test after enrollment, vendor, notice, or communication changes.

Document how the plan treats retroactive enrollment and termination changes discovered after the cohort locks. Preserve the original denominator and add a reconciliation adjustment with reason, evidence, and decision rather than silently rewriting history. Review duplicates caused by product overlap or identifier changes. Keep suppression reasons narrow and approved so a general marketing opt-out does not accidentally suppress a required privacy communication.

Test the individual's ability to obtain the notice from every instruction in the reminder. Call the number, submit the paper request, open the link without login, and confirm the current version and correct plan. Monitor route availability throughout the cycle. During vendor handoff, retrieve recipient-level send and failure evidence before access ends. Store enough data to prove which covered cohort received which approved text, while applying appropriate access and retention controls.

Plan the next cycle before closing the current one. Record the cycle end, responsible function, expected source system, approved communication routes, retention location, and earliest preparation date. Preserve lessons about bad addresses, merged identifiers, product transitions, representative records, and vendor limitations. A change in administrator or brand should not reset the compliance calendar without a supported legal decision. During acquisitions or plan migrations, assign ownership for historical evidence and the next due event so neither organization assumes the other will send it.

Have the receiving owner acknowledge the handoff, confirm access to historical cohort and delivery evidence, and run a test extraction well before the next deadline. Escalate missing source data while recovery options remain available.