Notice of Privacy Practices template
A free, editable HIPAA Notice of Privacy Practices in plain language, with every element 45 CFR 164.520 requires for a covered health care provider.
This notice
Free
Word .docx · 2–3 pages · 77 KB · no sign-up
Download the free templateFull therapy practice kit
$299 one time
$249 launch price for the first 30 days after sales open · 12 months of updates
- This notice, plus the acknowledgment form and a staff guide
- Policies, risk analysis, patient forms, BAA
- A filled-in example practice to copy from
Version 1.0 · Checked against 45 CFR on · Made by hipaa.systems — how we check · Not legal advice
At a glance
This free Notice of Privacy Practices template is an editable Word notice for health care providers, written in plain language on the structure of the HHS model notice. It contains the elements 45 CFR 164.520(b) requires, with conditional paragraphs you must keep if you fundraise or create, keep or receive 42 CFR Part 2 records. Give it at the first service, post it at your office and on your website, and make a good-faith effort to get a written acknowledgment.
| Format | Word (.docx), 2–3 pages depending on the editor; opens in Google Docs |
|---|---|
| Built on | 45 CFR 164.520 |
| For | Health care providers — health plans need a different notice |
| Keep | Each version for six years (45 CFR 164.520(e), 164.530(j)) |
Who must provide it
- Every covered health care provider — one that transmits health information electronically, itself or through a billing service, in a HIPAA standard transaction such as an insurance claim
- Health plans have their own notice and delivery rules; this template is for providers
Before you publish it
- Fill in your practice name, privacy contact and effective date
- Keep the conditional paragraphs when they apply — fundraising, and the substance use disorder section if you create, keep or receive 42 CFR Part 2 records — and delete them only if they don't
- Add any stricter protection your state gives, for example for mental health, HIV or genetic information
- A federally assisted substance use disorder program (42 CFR Part 2) must give a notice that meets 42 CFR 2.22 — it may be combined with this one, but this template doesn't contain all its elements
How to give it to patients
- In person: no later than the first service; after an emergency, as soon as practicable
- If the first service is delivered electronically, send the notice automatically, at the same time as you respond to the patient's first request for service
- By email only if the patient agrees to an electronic notice — they can always ask for paper
- Post it in a clear and prominent place at your office, keep copies to hand out, and post it on your website if you have one
Acknowledgment is not consent
- Make a good-faith effort to get the patient's written acknowledgment that they received the notice
- The patient doesn't have to sign. If they don't, note your effort and why it failed — the notice still applies
When to revise it
- Revise it promptly when you make a material change to a practice it describes; unless a law requires otherwise, don't put the change into effect before the revised notice takes effect
- Then post the new version at the office and on your website, and give it to anyone who asks
Preview
Tap a page to open the full PDF in a new tab.
Download the free template Word .docx · 2–3 pages · 77 KB
See the legal requirements this notice covers
| Requirement | Where | Source |
|---|---|---|
| Required header statement | Top of page 1 | 45 CFR 164.520(b)(1)(i) |
| Uses and disclosures, with examples | Section 3 | 45 CFR 164.520(b)(1)(ii) |
| Choices, authorizations and fundraising | Section 2 | 45 CFR 164.520(b)(1)(ii)(E), (iii) |
| Part 2 records received from a Part 2 program — limits on use in proceedings | Section 4 | 45 CFR 164.520(b)(1)(iii)(D) |
| Fundraising with Part 2 records you create or keep — the right to opt out | Section 4 | 45 CFR 164.520(b)(1)(iii)(E) |
| Patients' rights and how to complain | Section 1 | 45 CFR 164.520(b)(1)(iv), (vi) |
| Your duties and changes to the notice | Sections 5–6 | 45 CFR 164.520(b)(1)(v) |
| Contact person and effective date | Section 7 | 45 CFR 164.520(b)(1)(vii)–(viii) |
Frequently asked questions
Does the patient have to sign the notice?
No. You make a good-faith effort to get a written acknowledgment that the patient received it. Signing is the patient's choice, and the notice applies either way.
Must the notice be on our website?
Yes, if your practice has a website with information about its services (45 CFR 164.520(c)(3)(i)).
Can we email the notice?
Yes, if the patient agrees to an electronic notice. Give a paper copy if you know the email failed, and whenever the patient asks.
Do we have to send a revised notice to every patient?
No, not as a provider. From its effective date, give the revised notice to anyone who asks, post it at your office and on your website, and use it for new patients.
Is there an official HHS notice?
HHS publishes model notices that providers can adapt; there is no mandatory form. Ours follows the structure of the HHS model, includes the 42 CFR Part 2 statements required since the February 16, 2026 compliance date, and leaves out the 2024 reproductive health statements a court vacated in 2025.