What Is a HIPAA Notice of Privacy Practices?

A Notice of Privacy Practices is a plain-language notice that describes how a covered entity may use and disclose PHI, the individual's rights, and the entity's legal duties. Health plans and most health care providers must provide it. Providers with a direct treatment relationship generally must make a good faith effort to obtain written acknowledgment of receipt, except in emergencies.

Requirement. 45 CFR 164.520 requires covered entities to provide adequate notice of their privacy practices, with limited exceptions such as certain group health plans and correctional institutions.

Required content (164.520(b)). The notice must include a prescribed header, descriptions of permitted uses and disclosures with examples, a statement that other uses require authorization, a description of individual rights, the covered entity's duties, how to file complaints with the covered entity and with HHS, a contact person, and an effective date.

Providers with direct treatment relationships. Direct-treatment providers provide the notice by first service delivery, except that in an emergency it is due as soon as reasonably practicable afterward; the written-acknowledgment effort requirement does not apply to emergency treatment. If acknowledgment is not obtained, the provider must document its good faith efforts and the reason. Where the provider maintains a physical service delivery site, it must post the notice in a clear and prominent location (164.520(c)(2)).

Websites. A covered entity that maintains a website with information about its services or benefits must post the notice prominently on it (164.520(c)(3)).

Health plans. A health plan must provide the notice at enrollment and notify individuals of its availability at least once every three years.

2026 updates. As of February 16, 2026, applicable NPPs must include the surviving substance-use-disorder-records provisions. HHS issued revised February 2026 HIPAA provider and plan models and Part 2 patient-notice models. The June 18, 2025 Purl order vacated most of the 2024 reproductive health rule, including 164.520(b)(1)(ii)(F), (G) and (H), but did not vacate the remaining NPP modifications. Text still printed in the eCFR for the vacated provisions should not be treated as operative.

Model notices. HHS publishes model notices that covered entities may adapt.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."