A notice of privacy practices (NPP) is the document HIPAA requires you to give patients under 45 CFR 164.520. It tells patients how you use and share their health information. It lists patient rights and your duties. It must carry the required header, a contact and an effective date. Providers hand it out by the first visit and post it.
In 2011, Cignet Health of Prince George's County, Maryland received a $4.3 million civil money penalty, the first CMP ever issued under the HIPAA Privacy Rule. The core violation: denying 41 patients access to their medical records, a right that every notice of privacy practices is required to explain. Cignet then refused to cooperate with OCR's investigation, compounding the penalty from $1.3 million to $4.3 million.
Your notice of privacy practices (NPP) is not a formality. It is a federal requirement under 45 CFR 164.520 that tells every patient exactly how their protected health information (PHI) will be used, what rights they have over it, and what to do if those rights are violated. Get it wrong, or fail to distribute it, and OCR has grounds for enforcement before a single breach occurs.
This guide covers what the HIPAA notice of privacy practices must contain, who must provide one, how to distribute it, common mistakes, and a checklist you can use to verify your NPP meets current requirements.
What Is a Notice of Privacy Practices?
A notice of privacy practices (NPP) is a written document that explains to patients how a covered entity may use and disclose their PHI, what rights they have regarding that information, and how they can file a complaint if they believe their rights have been violated.
Under the HIPAA Privacy Rule, covered entities (healthcare providers who conduct electronic transactions, health plans, and healthcare clearinghouses, with one clearinghouse exception explained below) must develop, maintain, and distribute an NPP. The requirement is codified in 45 CFR 164.520.
The NPP is not a consent form. It is a unilateral notice from the covered entity to the patient. The patient does not sign the NPP itself.
Instead, a healthcare provider who treats the patient directly must make a good faith effort (a real, honest try) to get a written acknowledgment of receipt. That is a signed note saying the patient got the notice. If the patient refuses to sign, the provider writes down the attempt and the reason. Then treatment goes ahead.
Business associates do not issue their own NPP. Their obligations are governed by the business associate agreement (BAA), not the notice requirement. For more on that distinction, see our guide to business associate agreements.
Who Must Provide a Notice of Privacy Practices?
Three categories of covered entities must provide an NPP:
- Healthcare providers who transmit health information electronically in connection with a HIPAA-covered transaction (claims, eligibility checks, referral authorizations). This includes physicians, dentists, chiropractors, pharmacies, hospitals, nursing facilities, and most clinical practices.
- Health plans, including group health plans, health insurance issuers, HMOs, Medicare, and Medicaid programs.
- Healthcare clearinghouses that process health information received from another entity into a standard format. There is one exception. A clearinghouse that handles PHI only as a business associate (a vendor working for another covered entity) does not need its own NPP.
If your practice bills insurance electronically, you are a covered entity and you need an NPP. There is no small practice exemption.
Required Content Under 45 CFR 164.520
The Privacy Rule specifies exactly what a HIPAA notice of privacy practices must contain. Missing any required element means your NPP is non-compliant, regardless of how polished it looks.
One warning: the online eCFR (the government website copy of the rules) still shows three items, (b)(1)(ii)(F), (G) and (H). A 2024 rule added them to protect reproductive health care information. In June 2025, a federal court vacated (cancelled) the reproductive health parts of that rule in Purl v. HHS. Those three items were part of what it cancelled, so they cannot be enforced. Do not add them to your NPP just because the eCFR shows them.
1. Header Requirement
The notice must include this exact statement. Put it at the top as a header, or display it somewhere patients will clearly see it: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
This is not optional language. The rule gives the exact wording. Do not bury it or reword it. Either one leaves a compliance gap.
2. Uses and Disclosures of PHI
The NPP must describe, with at least one example for each, how the covered entity may use or disclose PHI for:
- Treatment: sharing records with referring physicians, specialists, or labs
- Payment: submitting claims to insurers, verifying coverage
- Healthcare operations: quality assessments, training, audits, compliance activities
The notice must also describe other permissible uses and disclosures that do not require patient authorization, including disclosures for public health activities, law enforcement, judicial proceedings, and certain research activities.
If the covered entity plans to contact patients to raise money, the NPP must say so in its own separate statement. It must also explain that patients can opt out (say no to those messages). The NPP must also explain which uses of PHI need the patient's written authorization (signed permission). These include most marketing, any sale of PHI, and most uses of psychotherapy notes. The NPP must say that any use not described in the notice also needs written authorization. It must also say that the patient can take back an authorization later.
3. Individual Rights
The NPP must inform patients of every right they hold under the Privacy Rule:
- Right to access their PHI and obtain copies (45 CFR 164.524)
- Right to request amendments to their records (45 CFR 164.526)
- Right to an accounting of disclosures (45 CFR 164.528)
- Right to request restrictions on uses and disclosures
- Right to request confidential communications (e.g., calling a different phone number)
- Right to receive a paper copy of the NPP upon request
- Right to be notified of a breach of unsecured PHI
For each right, the NPP must briefly explain how the patient can use it. Naming the right alone is not enough. One right needs extra detail: the right to request restrictions (limits on how you use or share their information). The NPP must say the practice does not have to agree to these requests. There is one exception. If a patient paid in full out of pocket and asks that the information not go to their health plan, the practice must agree.
4. Covered Entity Duties
The NPP must contain a statement that the covered entity is required by law to:
- Maintain the privacy of PHI
- Provide the notice of its privacy practices
- Abide by the terms of the notice currently in effect
- Notify affected individuals following a breach of unsecured PHI
A covered entity may want future changes to cover PHI it already holds. If so, the notice must say it reserves the right to change the notice's terms for all PHI it keeps. That statement must also explain how patients will get the revised notice.
5. Contact Information and Complaints
The NPP must include:
- The name (or title) and phone number of a contact person or office for further information or to file complaints with the covered entity
- A statement that the patient can complain to the covered entity and to the Secretary of HHS, plus a short explanation of how to file a complaint with the covered entity
- A statement that the individual will not be retaliated against for filing a complaint
The contact person is typically the HIPAA compliance officer or privacy officer.
6. Effective Date
Every NPP must include the date on which the notice is effective. This is not the date the patient received the notice; it is the date the notice's terms became operative. That date cannot be earlier than the date the notice was printed or published. When you revise your NPP, the effective date must be updated.
NPP vs. HIPAA Authorization Form
Practices frequently confuse the NPP with the HIPAA authorization form. They serve entirely different purposes:
| Document | Purpose | Patient Signature Required? | Legal Basis |
|---|---|---|---|
| Notice of Privacy Practices (NPP) | Informs patient how PHI will be used; describes patient rights | No, only acknowledgment of receipt | 45 CFR 164.520 |
| HIPAA Authorization Form | Grants permission for a specific use or disclosure of PHI not otherwise permitted | Yes, patient must sign to authorize | 45 CFR 164.508 |
The NPP is a one-way notice: "here is what we do with your data." The authorization is a two-way agreement: "we need your specific permission to do this particular thing." Combining them into a single form creates confusion and may render both documents deficient.
For full authorization requirements, see our guide to HIPAA authorization form requirements.
When and How to Distribute the NPP
Healthcare Providers
Healthcare providers with a direct treatment relationship must:
- Provide the NPP to every patient no later than the first date of service delivery, including service delivered electronically
- Make a good faith effort to obtain written acknowledgment that the patient received the notice
- Have the NPP available at the service delivery site for patients to take with them
- Post the NPP in a clear and prominent location at the facility
- Post the NPP on the practice's website, if the practice has one
If the first service is provided in an emergency, the provider must provide the NPP as soon as reasonably practicable after the emergency ends. The acknowledgment step does not apply in an emergency.
Health Plans
Health plans must:
- Provide the NPP to enrollees at the time of enrollment
- Share any material change (a change to a key term of the notice). A plan that posts its notice on its website must post the change by the date it takes effect. It must also send the revised notice, or word of the change, in its next annual mailing. A plan that does not post online must send the revised notice within 60 days of the material revision.
- At least once every three years, tell enrollees (people covered by the plan) that the notice is available and how to get it
Electronic Notice Rules
Covered entities may email the NPP if the patient agrees to get it that way. The patient must not have taken that agreement back. If the covered entity knows the email did not go through, it must give a paper copy. If the first service happens electronically, the provider must send the notice electronically when the patient first asks for service. It must do this automatically, without waiting to be asked. A patient who got the notice electronically can still ask for a paper copy at any time.
Common NPP Mistakes
1. Using a template without customization. HHS provides model NPP language, but a model is a starting point, not a finished document. Your NPP must reflect your specific practices, including any uses for fundraising, research, or marketing. A generic template that omits your actual practices creates a gap between what the notice says and what you do.
2. Failing to update after regulatory changes. 42 CFR Part 2 is the federal rule that protects substance use disorder (SUD) treatment records. HIPAA changes tied to Part 2 had a compliance date (the date you must follow them) of February 16, 2026. If you receive or keep SUD records from Part 2 programs, your NPP must now include specific statements about how you handle those records. If you hold these records and your NPP has not been revised since early 2026, it is likely missing these statements.
3. Not obtaining the acknowledgment. You do not need the patient's signature to treat them, but you must document a good faith attempt. Skipping the acknowledgment entirely leaves no record that the notice was offered. In an OCR investigation, that gap is difficult to explain.
4. Omitting the breach notification statement. The 2013 Omnibus Rule added a required statement about breach notification. That rule put the HITECH Act's changes into the HIPAA rules. NPPs written before 2013 and never updated are missing this statement.
5. Treating the NPP as a consent form. Asking patients to "sign the HIPAA form" conflates the NPP with an authorization or consent. The patient is acknowledging receipt, not consenting to anything. Staff should be trained to explain the distinction.
6. Posting only online. A website posting alone does not satisfy the distribution requirement for providers. The NPP must be available in physical form at the service delivery site and provided to patients at the first service encounter.
Enforcement: What Happens When NPPs Are Wrong
NPP problems often come to light during OCR investigations that start with a patient complaint. A typical example: a patient tried to use a right described in (or missing from) the NPP and was turned down.
Cignet Health: $4.3 Million (2011)
The first civil money penalty under the HIPAA Privacy Rule. Cignet denied 41 patients access to their medical records (a right the NPP is required to describe) and then refused to cooperate with OCR's investigation. The penalty: $1.3 million for the access violations, plus $3 million for willful neglect in refusing to cooperate with OCR.
Right of Access Initiative (2019 to 2026)
OCR settled its first Right of Access Initiative case in September 2019. It was still announcing access cases in 2026. Recent examples include a $70,000 civil money penalty (a fine OCR imposes) against Gums Dental Care (October 2024).
Another is a $200,000 penalty against Oregon Health & Science University (March 2025). Both were for not giving patients their records on time. Each of these cases involved a patient right that the NPP must explain. When a patient reads their NPP, understands they have a right to access their records, requests those records, and is denied, that is when complaints are filed and investigations begin.
Pattern: NPP Is the Trigger
In patient complaints to OCR, the NPP is often either how the patient learned about their right (and found it was violated) or the document whose inadequacy made the violation worse. An incomplete NPP that fails to describe the right to access, the right to amend, or the right to an accounting of disclosures leaves the organization exposed when those rights are exercised.
Notice of Privacy Practices Checklist
Use this checklist to verify your NPP meets current HIPAA requirements:
| Requirement | Citation | Present? |
|---|---|---|
| Required header ("THIS NOTICE DESCRIBES...") | §164.520(b)(1)(i) | ☐ |
| Description of uses/disclosures for treatment, payment, operations (with examples) | §164.520(b)(1)(ii)(A) | ☐ |
| Description of other permissible uses/disclosures (public health, law enforcement, etc.) | §164.520(b)(1)(ii)(B-D) | ☐ |
| Statement about fundraising and opt-out right (if applicable) | §164.520(b)(1)(iii)(A) | ☐ |
| Uses that need the patient's written authorization (marketing, sale of PHI, psychotherapy notes); a statement that uses not in the notice also need it; and the patient's right to take it back | §164.520(b)(1)(ii)(E) | ☐ |
| Right to access and obtain copies of PHI | §164.520(b)(1)(iv) | ☐ |
| Right to request amendment of records | §164.520(b)(1)(iv) | ☐ |
| Right to accounting of disclosures | §164.520(b)(1)(iv) | ☐ |
| Right to request restrictions, including when the practice must agree | §164.520(b)(1)(iv) | ☐ |
| Right to confidential communications | §164.520(b)(1)(iv) | ☐ |
| Right to a paper copy of the NPP | §164.520(b)(1)(iv) | ☐ |
| Statement that you must notify affected patients after a breach | §164.520(b)(1)(v)(A) | ☐ |
| Statement of covered entity's duties | §164.520(b)(1)(v) | ☐ |
| Statement that you may change the notice's terms, and how patients get the revised notice | §164.520(b)(1)(v)(C) | ☐ |
| Contact person name/title and phone number | §164.520(b)(1)(vii) | ☐ |
| Right to file complaint with covered entity | §164.520(b)(1)(vi) | ☐ |
| Right to file complaint with HHS Secretary | §164.520(b)(1)(vi) | ☐ |
| No retaliation statement | §164.520(b)(1)(vi) | ☐ |
| Effective date | §164.520(b)(1)(viii) | ☐ |
| Substance use disorder (SUD) record statements (only if you receive or keep 42 CFR Part 2 records; compliance date February 16, 2026) | §164.520(b)(1)(iii)(D) and (E) | ☐ |
If any box that applies to you is unchecked, your NPP needs revision before your next patient encounter.
When to Update Your NPP
The Privacy Rule requires that covered entities promptly revise and distribute their NPP when a material change occurs. Triggers include:
- Regulatory changes: the 42 CFR Part 2 statements are the latest example. They apply to practices that hold Part 2 records, with a compliance date of February 16, 2026.
- New uses of PHI: any new use or sharing of PHI that your current notice does not describe, such as starting fundraising contacts
- Organizational changes: merging with another practice, or joining an Organized Health Care Arrangement (OHCA). An OHCA is a group of providers that may share one joint notice.
- Privacy practice changes: modifying how you handle access requests, amending your directory policy, or changing breach notification procedures
When you revise the NPP, you must make the revised notice available at your facility, post it on your website, and provide it to anyone who requests it. Healthcare providers do not need to re-distribute to every existing patient, only to new patients and anyone who asks. Health plans that post the notice online must post the change by the date it takes effect and cover it in their next annual mailing. Plans that do not post it online must send it within 60 days.
Frequently Asked Questions
What is a notice of privacy practices?
A notice of privacy practices (NPP) is a document required by 45 CFR 164.520 that informs patients how a covered entity uses and discloses their protected health information, what rights patients have over their data, and how to file a complaint if those rights are violated.
What is the purpose of a notice of privacy practices?
The purpose is to ensure transparency. Patients must know how their PHI will be used before they receive care, what rights they can exercise (access, amendment, accounting of disclosures, restrictions, confidential communications), and who to contact if something goes wrong.
Does a patient have to sign the notice of privacy practices?
No. The NPP is not a consent form. Patients are asked to sign an acknowledgment of receipt, not the notice itself. If a patient refuses to sign the acknowledgment, write down your good faith attempt and the reason it was not signed. Then go ahead with care.
Is the notice of privacy practices the same as a HIPAA consent form?
No. The NPP is a unilateral notice from the covered entity to the patient. A HIPAA authorization form is a patient-signed document granting permission for a specific disclosure. The NPP informs; the authorization permits.
How often must the notice of privacy practices be updated?
There is no fixed schedule. The NPP must be revised whenever a material change occurs to the covered entity's privacy practices. Health plans that post the notice online must post the change by the date it takes effect and cover it in their next annual mailing. Plans that do not post it online must send it within 60 days. Healthcare providers must give the revised NPP to anyone who asks and post it at the facility, and on their website if they have one.
Do I need to update my NPP for the 2026 42 CFR Part 2 changes?
If your practice receives or keeps substance use disorder (SUD) records from a Part 2 program, yes. HIPAA changes tied to Part 2 have a compliance date of February 16, 2026. They require your NPP to explain how you handle those records. If you do not hold Part 2 records, this specific update does not apply, but you should still review your NPP for other required elements that may have been missed in prior versions.
Key stat: Under 45 CFR 164.520, healthcare providers who treat patients directly must provide the NPP no later than the first service delivery and must make a good-faith effort to obtain written acknowledgment. The NPP must also be posted in a clear and prominent location at the practice and on the practice website if one exists.
Sources
- 45 CFR 164.520: Notice of Privacy Practices for Protected Health Information
- HHS OCR: Cignet Health Civil Money Penalty
- HHS OCR: Enforcement Highlights
- 45 CFR 164.508: Uses and Disclosures Requiring Authorization
- 45 CFR 164.524: Access of Individuals to Protected Health Information
- 42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records
Your notice of privacy practices is the single document every patient receives. It explains their rights and states your duties. It is often the reference point when a patient complains or OCR investigates. Use the checklist above to verify yours meets every requirement under 45 CFR 164.520, then make sure your staff knows how to distribute it and obtain the acknowledgment.
One Guy Consulting offers affordable HIPAA compliance packages for practices of all sizes. Explore our HIPAA compliance packages.