Notice of Privacy Practices
What the Notice of Privacy Practices must say, when and how a practice must provide it, where it must be posted, and what changed in 2026.
Notice of Privacy Practices at a glance
The Notice of Privacy Practices (NPP) is the document HIPAA covered health care providers and health plans must make available to patients and members, explaining how it uses and discloses their health information, their rights, and the entity's legal duties. Under 45 CFR 164.520, a provider with a direct treatment relationship must give it no later than the first service, make a good-faith effort to get written acknowledgment, post it at the office and prominently on its website, and keep copies for six years.
| Rule | HIPAA Privacy Rule, 45 CFR 164.520 |
|---|---|
| Required header | "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY." |
| When to give it | No later than the first service delivery, including telehealth |
| Acknowledgment | Good-faith effort to get a written acknowledgment; document if you couldn't |
| Where to post | In the office, and prominently on your website if you have one |
| 2026 update | Changes tied to substance use disorder (Part 2) records applied from Feb 16, 2026; reproductive-health changes were vacated |
Patients have a right to adequate notice of how their information may be used and disclosed, their rights, and your legal duties (45 CFR 164.520(a)). The Notice of Privacy Practices is how you meet that right.
What it must contain
The notice must be in plain language and include (164.520(b)):
- the required header shown above, displayed prominently;
- the uses and disclosures you may make, with examples, including those for treatment, payment and health care operations;
- that other uses require the patient’s written authorization, which they can revoke;
- the patient’s rights — to request restrictions and confidential communications, to inspect and get copies, to amend, to an accounting of disclosures, and to a paper copy of the notice;
- your legal duties, including notifying patients after a breach of unsecured PHI;
- how to complain to you and to HHS, and that you won’t retaliate;
- a contact person and an effective date.
How a practice must provide it
For providers with a direct treatment relationship (164.520(c)(2)):
- Give it no later than the first service delivery — including telehealth.
- Ask for a written acknowledgment of receipt; if the patient won’t sign, document your effort and the reason.
- Post it in a clear, prominent place in your office and have copies available.
- Post it on your website prominently if you have one (164.520(c)(3)); you can email it to patients who agree to electronic notice.
- Revise it when your practices change materially, and make the new version available from its effective date.
- Keep copies of each version and the acknowledgments for six years (164.520(e)).
What changed in 2026
Rules published in 2024 required updates to notices. The changes tied to substance use disorder treatment records (42 CFR Part 2) had a compliance date of February 16, 2026 and remain in force; they matter most if you receive or maintain Part 2 records. The reproductive-health changes were vacated by a federal court in June 2025 and are not required. If you updated your notice for those, review it with counsel.
Guides
- HIPAA compliance →What HIPAA compliance actually means for a small practice or health tech company, what it consists of, and what it is not.
- HIPAA compliance checklist →A practical HIPAA checklist for small practices and business associates, with each item linked to the rule behind it — not a list of things to buy.
- HIPAA patient rights →The rights HIPAA gives patients over their health information, with deadlines, and what a practice must do to honor each one.
Related requirements
Frequently asked questions
Do I need a Notice of Privacy Practices on my website?
Yes, if your practice has a website that provides information about your services, the notice must be prominently posted on it and available electronically (45 CFR 164.520(c)(3)).
Does the patient have to sign the Notice of Privacy Practices?
Patients are not required to sign. You must make a good-faith effort to get a written acknowledgment of receipt and document why if you couldn't.
Is there an official NPP template?
HHS publishes model notices of privacy practices that providers can adapt. You still need to tailor them to your practice and keep them current.
Did the Notice of Privacy Practices change in 2026?
Updates tied to the 2024 alignment with 42 CFR Part 2 (substance use disorder records) had a February 16, 2026 compliance date. Reproductive-health changes from 2024 were vacated by a federal court in 2025 and are not required.