Plain Language Privacy Notice Proposed to Avoid “HIPAA-ese”

By Beth Steele, J.D., Editor, CCH Financial Privacy Law Guide.

The complexity of these new notices can be overcome by a “two-layer” approach, she said. The first layer would be a “plain language” version; the second layer would be a more detailed version. Key elements of an entity’s information practices would be contained in the plain language layer. Sotto, a partner at Hunton & Williams’ New York office, is working with the firm’s Center for Information Policy Leadership to develop such a notice.

Plain Language Approach

Simplifying complexity through plain language finds support from government agencies and industry leaders, Sotto indicates. The Center has consulted with the Federal Trade Commission (FTC) and the Office for Civil Rights of the Dept. of Health and Human Services (HHS). “In fact, portions of our comment letter advocating the layered approach are contained in the preamble to the modified HHS rules of August 14,” she said.

The Center will put the plain language version to a test soon, using focus groups to gauge consumer response. “In this way, we will be able to ensure that the ‘highlights notice’ meets consumer needs, allays consumer fears and generates deeper trust in the entity,” Sotto indicated. IBM, Kodak, Fidelity and other industry leaders also support the concept of the simplified notices, she continued. “They all agree that privacy notices are problematic” without more understandable language. Providers of notices are, of course, affected if there is a negative reaction by consumers, she said.

Learning from GLB Mistakes

The Gramm-Leach-Bliley Act has been widely criticized over notices required of financial institutions. Most customers and consumers do not understand the notices, participants said at a joint agency workshop on the notices held at the FTC in December 2001. The health privacy rules from HHS also require notices. “These notices will encounter the same negative reaction,” Sotto predicted.