I read the "once every three years" on the HHS site and that was under health plans as the covered entity. For providers, I only read that it's to be provided at the intial encounter. I think, but I'm not positive, that our practice hands them out if we haven't seen a patient back in the office for over a year.
Also...
I just had to take a HIPAA compliance test for work and the materials we received states this:
Acknowledgment of Receipt -
The Rule requires a practice to obtain an acknowledgment of receipt from the patient at the time of their initial encounter with the practice. This is a simple statement that the patient has received the practice's notice, and is a one-time event. This means that the practice does not have to obtain additional acknowledgements whenever it changes the content of its notice.
The right to receive a copy of the Notice of Privacy Practices -
This informs patients that they have a right to receive a copy of the notice (i.e., this is why handout copies must be available for patients to take with them). It will also state that your
practice has the right to change the terms of the notice at any time. And, as needed, new versions of the notice will be available upon request. Note that while a copy of the revised notice must be available for the patient to obtain upon request, a practice is not required to automatically mail or distribute copies of a revised notice to patients.
Not sure how up to date the above is, but it's dated for the April 2013 test we had to take.