Guide

The NPP: contents, posting, and the signature myth

Summary

Your Notice of Privacy Practices must contain a required header, a description of your uses and disclosures for treatment, payment, and operations, the uses that need an authorization, the patient's rights, your legal duties, how to complain, and a contact and effective date. Give it at first service and post it in the office and on your website. A patient's signature only acknowledges receipt — it is not consent to treatment, and you cannot require it.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What must a Notice of Privacy Practices contain?

A compliant Notice of Privacy Practices, or NPP, tells patients how you may use and disclose their PHI and what rights they hold over it 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule requires covered entities to provide a notice of privacy practices describing uses, disclosures, and individual rights.. The Privacy Rule sets the required contents at 45 CFR 164.520: a prominent header, a description of your uses and disclosures, the uses that need an authorization, the individual's rights, your legal duties, how to complain, and a contact and effective date 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement.. Miss an element and the notice is incomplete.

Think of the NPP as a fixed template with mandatory sections rather than free-form marketing copy. HHS publishes model notices you can adapt, but the obligation is to cover every required element in language a patient can read. For a solo practice, one well-built notice serves for years, updated only when your practices or the law materially change.

The header and the uses-and-disclosures section

Every NPP opens with a required header, prominently displayed, stating that the notice describes how medical information about the patient may be used and disclosed and how they can get access to it 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement.. Below it, you describe the uses and disclosures you make for treatment, payment, and health care operations, with enough example to be meaningful, plus any other uses the law permits or requires. This section is where a patient learns what routine sharing to expect.

The notice must also flag the uses that require the patient's written authorization. Most uses and disclosures of psychotherapy notes, uses of PHI for marketing, and any sale of PHI require a prior authorization, and the notice has to say so 3Ref 3HHS Office for Civil Rights (2026).Marketing.That uses of PHI for marketing require prior authorization, one of the authorization-required categories the notice must disclose.. If you handle photos and testimonials or run any promotion touching patient information, the marketing rules are the reason your NPP names authorization as the gate — describe the category, do not bury it.

The individual-rights section

The NPP must lay out the rights every patient has over their information, because the notice is how most patients first learn them. At minimum it describes the right to access and get a copy of their records, to request an amendment, to an accounting of certain disclosures, to request restrictions on uses and disclosures, to request confidential communications, to a paper copy of the notice, and to be notified following a breach of their unsecured PHI 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access element the notice must describe — the 30-day response timeline, the cost-based fee, and the exclusion of psychotherapy notes..

Two of these carry their own machinery you should be ready to run. The right of access has a 30-day response timeline and a limited cost-based fee, and psychotherapy notes sit outside it 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access element the notice must describe — the 30-day response timeline, the cost-based fee, and the exclusion of psychotherapy notes.. The breach-notification right is the patient-facing side of the rule that also drives your reporting duties 5Ref 5HHS Office for Civil Rights (2026).Breach Notification Rule.The patient's right to be notified following a breach of unsecured PHI, which the notice must describe.. The notice states the rights; your internal workflow is what actually honors them — an amendment request or the accounting of disclosures should each have a known path before one arrives.

Posting and distribution

You must both hand out the notice and post it. A direct treatment provider gives the NPP to the patient no later than the date of first service delivery and makes a copy available on request 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement.. You post the notice in a clear and prominent location in the office where patients are likely to see it, and if you maintain a website that describes your services, you post the notice prominently on the site as well 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement..

For a telehealth or website-first practice, the electronic posting is not optional garnish — it is where many patients will actually encounter the notice. Provide it at the first visit through your portal or intake flow, keep the current version posted, and make sure the copy patients can download matches the one on your wall. One current notice, in every place a patient meets your practice, is the standard.

Keeping it current — and what OCR checks

The NPP is a living document. When your privacy practices or the governing law materially change, you must promptly revise the notice and make the new version available; the notice itself must reserve your right to change its terms and apply the change to all PHI you hold 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement.. Keep prior versions and a record of when each took effect — HIPAA documentation is retained for six years, and an out-of-date notice is a common finding.

OCR does look at this. It enforces the Privacy Rule through complaint investigations and compliance reviews and has acted against very small practices, and a missing or stale NPP is an easy thing for an investigator to spot 6Ref 6HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces the Privacy Rule through investigations and reviews, including actions against very small practices, where a missing or stale notice is a finding.. The civil-money-penalty framework applies to solo practices as it does to systems 7Ref 7Office of the Federal Register (2026).45 CFR Part 160 — General Administrative Requirements.The civil-money-penalty framework that applies to solo practices as to larger entities.. If you are unsure whether HIPAA even applies to your setup, the covered-entity test comes first; if it does, a current, complete, posted NPP is one of the cheapest ways to stay on the right side of it.

Common questions

No. A direct treatment provider must make a good-faith effort to obtain a written acknowledgment that the patient received the notice, but the patient is not required to sign. If they decline, you document the good-faith effort and continue treatment. The signature acknowledges receipt only — it is not consent to treatment or agreement to your privacy practices, and you cannot condition care on it.

The notice needs a prominent header, a description of your uses and disclosures for treatment, payment, and operations, the uses that require authorization, the individual's rights, your legal duties, how to file a complaint with you and with HHS, a contact, and an effective date. Missing any required element makes the notice incomplete, which is a common and avoidable finding in a review.

Give it to each patient no later than the first service delivery and make copies available on request. Post it in a clear, prominent spot in the office where patients will see it, and if you maintain a website describing your services, post the current notice prominently there too. For a telehealth-first practice, the electronic posting is where most patients will actually encounter it.

Update it whenever your privacy practices or the applicable law materially change, then make the revised version available and post it. The notice should reserve your right to change its terms. Keep prior versions and their effective dates, since HIPAA documentation is retained for six years. There is no fixed annual requirement, but a notice that no longer matches your practices is a problem.

It must flag the uses that require a written authorization, and that category includes most uses of psychotherapy notes, uses of PHI for marketing, and any sale of PHI. You describe the category so patients know these uses are gated by their authorization. You do not reproduce the notes or the promotions themselves — you state that authorization is required before those uses occur.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the Privacy Rule requires covered entities to provide a notice of privacy practices describing uses, disclosures, and individual rights.
2.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓The operative notice requirements at 45 CFR 164.520 — required header and contents, the good-faith acknowledgment, posting and distribution, revision rules — and the six-year documentation-retention requirement.
3.HHS Office for Civil Rights (2026). Marketing. U.S. Department of Health and Human Services. linkThat uses of PHI for marketing require prior authorization, one of the authorization-required categories the notice must disclose.
4.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThe right-of-access element the notice must describe — the 30-day response timeline, the cost-based fee, and the exclusion of psychotherapy notes.
5.HHS Office for Civil Rights (2026). Breach Notification Rule. U.S. Department of Health and Human Services. linkThe patient's right to be notified following a breach of unsecured PHI, which the notice must describe.
6.HHS Office for Civil Rights (2026). HIPAA Compliance and Enforcement. U.S. Department of Health and Human Services. linkThat OCR enforces the Privacy Rule through investigations and reviews, including actions against very small practices, where a missing or stale notice is a finding.
7.Office of the Federal Register (2026). 45 CFR Part 160 — General Administrative Requirements. eCFR. link ✓The civil-money-penalty framework that applies to solo practices as to larger entities.

https://www.gale.care/for-providers/hip-npp-requirements · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers