A.- The HIPAA Notice of Privacy Practices needs to be provided once every three years. A reminder of the availability of the notice should be provided on the years the notice is not sent. Many employers include the HIPAA NPP in the annual open enrollment materials so they don’t have to track compliance with the three year distribution requirement.