The article “HIPAA Again: Confronting the Updated Privacy and Security Rules” [May/June 2013] mistakenly said the new HIPAA (Health Insurance and Portability and Accountability Act) rules require practices to alert patients in their Notice of Privacy Practices (NPP) if they send automated appointment reminders or communications about treatment alternatives or health-related benefits. In fact, if a practice receives remuneration from patients for sending such communications, it has to get an authorization from the patient to do so. But there is no requirement that these communications be included in the NPP. Also, the article mistakenly said practices must include in the NPP new liabilities associated with business associates under the updated HIPAA rules. This is also not necessary.