Answer:
The notice must describe:
How the Privacy Rule allows provider to use and disclose protected health information. It must also explain that your permission (authorization) is necessary before your health records are shared for any other reason
The organization’s duties to protect health information privacy
Your privacy rights, including the right to complain to HHS and to the organization if you believe your privacy rights have been violated
How to contact the organization for more information and to make a complaint