Notice of Privacy Practices Guide

A Notice of Privacy Practices explains how a HIPAA covered entity may use and disclose protected health information, what rights patients have, and what duties the organization must follow. For a medical or dental practice, the notice is not just a front-desk form. It has to match the practice's real privacy policies and be provided, posted, updated, and documented in the ways the HIPAA Privacy Rule requires.

This guide is written for practice owners, managers, and privacy leads who need to review an existing notice or build a reliable process around it. It focuses on the federal HIPAA requirements that matter most in day-to-day operations and shows where a broader HIPAA compliance program should connect the notice to policies, patient rights, staff training, and documentation.

Reviewed October 2026. HHS updated its model notices in February 2026 to reflect Part 2-related requirements for substance use disorder records. A federal court also vacated specific reproductive-health NPP provisions in June 2025, so those vacated provisions should not be treated as current requirements.

What Is a Notice of Privacy Practices?

A Notice of Privacy Practices, often called an NPP, is the HIPAA notice that tells individuals how a covered entity handles protected health information and explains their privacy rights. The requirement comes from the HIPAA Privacy Rule at 45 CFR 164.520.

The notice gives patients a practical summary of what the organization may do with their information for treatment, payment, health care operations, and other permitted purposes. It also tells them how to request access, ask for corrections, request certain restrictions, receive confidential communications, obtain an accounting of certain disclosures, and file a privacy complaint.

Who Has to Provide a HIPAA Privacy Notice?

Most HIPAA covered entities must maintain and provide a notice, but the exact delivery rules depend on the type of covered entity. For the medical and dental practices GlobeVM typically supports, the most relevant rule is the one for covered health care providers that have a direct treatment relationship with patients.

Covered health care providers

A covered provider with a direct treatment relationship must provide the notice no later than the date of first service delivery, except in an emergency. That includes an initial in-person appointment and can also include a first service delivered electronically.

A small practice does not receive an exemption simply because it has fewer employees or locations. If the organization is a covered health care provider under HIPAA, the NPP requirement applies based on its covered status and relationship with patients.

Health plans and other covered entities

Health plans also have NPP obligations, but their distribution rules differ from the rules for direct treatment providers. Certain clearinghouses, correctional institutions, and group health plans fall within limited exceptions described in 45 CFR 164.520.

Business associates

A business associate is not required to create its own Notice of Privacy Practices solely because it handles PHI for a covered entity. HHS makes that distinction clear. The covered entity must still make sure its privacy practices and its vendor relationships are consistent, which is one reason business associate agreements and the NPP should never contradict each other.

What Must a Notice of Privacy Practices Include?

A Notice of Privacy Practices must be written in plain language and contain the elements required by the Privacy Rule. A generic privacy policy on a website is not a substitute because the HIPAA notice has specific required content.

The notice should help a patient understand four practical things: how the organization may use PHI, when written authorization is needed, what rights the patient can exercise, and how to ask questions or file a complaint. It also has to explain the organization's own legal duties.

Permitted uses and disclosures

The notice must describe how PHI may be used or disclosed for treatment, payment, and health care operations, with enough detail for an individual to understand the practice. It also needs to describe other uses and disclosures that HIPAA permits or requires without written authorization.

When another law places tighter limits on a category of information, the notice has to reflect the more protective rule that applies. This matters for practices that handle especially sensitive records or operate under state privacy laws that impose additional restrictions.

Patient rights

The notice must explain the individual's rights and briefly tell the patient how to exercise them. Those rights include requesting access to records, requesting an amendment, asking for confidential communications, requesting certain restrictions, and receiving an accounting of certain disclosures.

The notice must also explain that a patient can request a paper copy, even when the patient agreed to receive the notice electronically. A useful notice gives enough direction that the patient knows which office or person to contact.

The practice's duties and complaint process

The practice must state that it is required by law to maintain the privacy of PHI, provide notice of its duties and privacy practices, and notify affected individuals after a breach of unsecured PHI when notification is required. The notice must also say that the organization will follow the terms of the notice currently in effect.

Patients must be told how to complain to the covered entity and to the Secretary of HHS if they believe their privacy rights were violated. The notice must also identify a contact person or office for more information and include an effective date.

What Changed for Notices of Privacy Practices in 2026?

The important 2026 change is that HHS revised its model Notice of Privacy Practices to reflect federal changes involving substance use disorder patient records protected by 42 CFR Part 2. HHS states that HIPAA covered health care providers and health plans had a February 16, 2026 compliance date for the remaining NPP modifications tied to those changes.

Practices should be careful with older summaries of the 2024 HIPAA reproductive-health rule. On June 18, 2025, a federal district court vacated most of that rule and specifically vacated three NPP provisions at 45 CFR 164.520(b)(1)(ii)(F), (G), and (H). HHS states that the remaining NPP modifications were not disturbed.

Part 2 records deserve a specific review

If a practice creates or maintains records protected by 42 CFR Part 2, its privacy notice requires careful review against the current Part 2 and HIPAA requirements. HHS updated its model notices in February 2026 specifically to help covered entities address these obligations.

A general medical practice should not assume that an old NPP remains accurate simply because its normal treatment and billing workflows have not changed. The safer approach is to compare the current notice with the current HHS model and the practice's actual data flows, then have specialized legal questions reviewed by qualified counsel.

When and How Must a Practice Provide the Notice?

A direct treatment provider must provide the notice no later than the first service delivery to the individual. In an emergency treatment situation, the provider can give the notice as soon as reasonably practicable after the emergency ends.

If a practice has a physical service location, it must keep the current notice available for individuals to take and post it where patients can reasonably be expected to see and read it. A practice that maintains a website with information about its services or benefits must prominently post the notice there and make it available electronically.

A provider may send the notice by email if the individual agrees to electronic delivery. If the provider knows the email failed, the rule requires a paper copy. For a first service delivered electronically, the electronic notice must be provided automatically and at the time of that first service request.

For a Los Angeles practice with online scheduling, telehealth, and several patient intake paths, this is a workflow issue as much as a document issue. The NPP should appear consistently across the front desk, website, patient portal, and remote intake process instead of depending on one staff member to remember it.

Does a Patient Have to Sign the Notice?

No. HIPAA does not require the patient to sign the Notice of Privacy Practices or agree to the privacy practices described in it. For a provider with a direct treatment relationship, the rule instead requires a good faith effort to obtain written acknowledgment that the patient received the notice.

If the patient refuses to sign or the acknowledgment cannot be obtained, the provider should document the good faith effort and the reason it was not obtained. In an emergency treatment situation, the provider does not have to make that acknowledgment effort.

This distinction matters because an acknowledgment is evidence of receipt, not permission for every use or disclosure of PHI. Uses that require a HIPAA authorization still require a valid authorization, regardless of whether the patient acknowledged receiving the NPP.

When Should You Update Your Notice?

A covered entity must promptly revise its notice whenever there is a material change to the uses or disclosures it makes, individual rights, its legal duties, or another privacy practice described in the notice. The revised notice must then be made available according to the rules that apply to the entity.

For a healthcare practice, material changes can come from a change in law, a new service line, a different information-sharing practice, or a policy change that affects what the notice says. A new EHR or vendor does not automatically require new NPP language, but it should trigger a review of whether the practice's actual privacy practices changed.

The NPP review should be coordinated with the rest of the practice's compliance and risk management work. A notice can be legally polished and still be wrong if the policies, vendor contracts, intake forms, and staff procedures behind it tell a different story.

How Long Should NPP Records Be Kept?

HIPAA documentation rules require covered entities to retain required documentation for six years from the date it was created or the date it was last in effect, whichever is later. For NPP compliance, that includes copies of notices issued and, where applicable, written acknowledgments or documentation of good faith efforts to obtain them.

A practice should be able to show which version of the notice was in effect at a given time and how patients were being given access to it. Version control is therefore part of compliance, not just an administrative convenience.

Common Notice of Privacy Practices Mistakes

The most common NPP problems are not complicated drafting errors. They are mismatches between the document and the way the practice actually handles patient information.

• Using a generic template without adapting it to the practice's real uses and disclosures.
• Leaving an outdated notice on the website after the office version has been revised.
• Treating the patient's acknowledgment as consent for uses that require authorization.
• Failing to document a good faith effort when an acknowledgment is not obtained.
• Forgetting to update the effective date when a revised notice takes effect.
• Ignoring more protective state or federal rules that apply to sensitive records.

Another mistake is reviewing the NPP by itself. A practice can say one thing in the notice while its intake process, patient portal, vendor arrangement, or internal policy does something else. That is why a full HIPAA compliance checklist should include the notice, its delivery process, and the supporting documentation.

How the NPP Fits Into a HIPAA Compliance Program

The NPP belongs to the Privacy Rule side of HIPAA, but it touches many operational areas. The rights described in the notice have to be supported by real procedures for access requests, amendments, complaints, confidential communications, and disclosure accounting.

Vendor management also matters because business associates may handle the same PHI described in your notice. The practice remains responsible for making sure its arrangements with those vendors support the privacy practices it represents to patients.

For local practices, a provider that supports managed IT services in Los Angeles can help keep the technology and documentation aligned, but legal responsibility does not transfer to the IT provider. The practice still needs an accountable privacy process, current policies, and qualified legal review where state or specialized privacy rules apply.

A Practical NPP Review Checklist

A practice manager can use the following review as a first pass before sending the notice for compliance or legal review. The goal is to confirm that the document, the delivery process, and the retained evidence all describe the same current practice.

1. Confirm that the notice names the correct covered entity or organized health care arrangement.
2. Check that uses, disclosures, patient rights, legal duties, complaints, contact information, and the effective date are covered.
3. Compare the notice with the current February 2026 HHS model rather than an older saved template.
4. Review whether Part 2 records or another more protective privacy rule affects the language.
5. Verify that the current notice is posted at the physical practice and on the service website.
6. Confirm that first-visit and electronic intake workflows provide the notice at the correct time.
7. Confirm that acknowledgment failures are documented instead of treated as patient consent problems.
8. Retain prior notices and acknowledgment documentation for the required HIPAA retention period.

The Bottom Line for Healthcare Practices

A Notice of Privacy Practices should accurately describe how your practice handles PHI today, not how a template assumed you handled it several years ago. The right process is to use the current federal requirements as the baseline, compare the notice with actual workflows, and revise it whenever a material privacy practice changes.

For practices reviewing the document in 2026, the Part 2 updates and the effect of the 2025 court decision deserve specific attention. Keeping the notice current is one part of a broader HIPAA program that also requires policies, training, vendor oversight, security controls, and evidence that the practice follows what it has written.

If your practice needs to confirm that its privacy notice, policies, and patient-data workflows still line up with current HIPAA requirements, GlobeVM can review the compliance gaps and help you build a practical path to address them.