Small employer group health plans must notify participants about their privacy rights under the Health Insurance Portability and Accountability Act at least once every three years. Plans with annual receipts of $5 million or less were first required to distribute the HIPAA privacy notice on April 14, 2004. (Some health care plans have adopted the practice of annually sending out the privacy notice to subscribers and enrollees, which satisfies the requirement. Employers are advised to check with their health plan provider to ensure the requirement is met.)