Generate a provider notice of privacy practices draft.

What the notice of privacy practices actually is

The notice of privacy practices explains, in plain language, how a covered entity may use and disclose protected health information, the individual's rights, the covered entity's duties, and how to ask questions or complain. Section 164.520 specifies a required header, content elements, revision rules, and distribution methods. A covered entity must abide by the terms of the notice currently in effect.

The notice should describe the organization's actual practices without omitting required content or promising limits the organization cannot follow. Review its statements and contact details when practices or applicable law change, and keep the current version available through the delivery channels that apply to the entity.

Who must provide one, and which exceptions matter

Section 164.520 generally covers healthcare providers, health plans, and healthcare clearinghouses that are covered entities. A covered provider with a direct treatment relationship must provide the notice no later than first service delivery, subject to the emergency rule, make a good-faith effort to obtain acknowledgment, and satisfy applicable physical-site and website posting duties. Health plans have their own enrollment, revision, and three-year reminder rules.

The rule also includes exceptions and reduced duties. A healthcare clearinghouse whose only PHI is received as a business associate is excepted. A fully insured group health plan may have reduced or no notice duties depending on the PHI it creates or receives. Inmates do not have a right to notice from a covered correctional institution. Business associates generally do not issue an NPP solely because of their business associate role. This generator is designed for covered healthcare providers. Health plans, clearinghouses, group health plans, correctional institutions, organized healthcare arrangements, and Part 2 programs need entity-specific review.

The content the rule requires, element by element

The notice must contain this statement as a header or otherwise display it prominently: THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. The generator uses that required statement without alteration.

From there, the notice must describe how the organization may use and disclose protected health information for treatment, payment, and health care operations, with at least one example for each purpose. It must also describe other purposes for which the Privacy Rule permits or requires use or disclosure without authorization in enough detail to put the reader on notice. More protective law, including 42 CFR part 2 when applicable, must be reflected. The generator tailors treatment, payment, and operations examples to the selected provider setting, but counsel should confirm that every description matches the provider's actual practices and applicable law.

The 2013 Omnibus changes require the notice to state that most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and disclosures that amount to a sale of protected health information will occur only with written authorization. The covered entity's duties section must state that affected individuals will be notified following a breach of unsecured PHI. The rights section must describe the restriction that applies when an individual pays for a service in full out of pocket and asks that the information not be disclosed to a health plan for payment or healthcare operations, unless disclosure is required by law.

Current notices also need the surviving Part 2-related changes that became mandatory on February 16, 2026. The notice must state that, to the extent the covered entity has substance use disorder records subject to 42 CFR part 2, those records or testimony about them will not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against the individual without written consent or the court-order process specified by Part 2. The generator includes that statement conditionally in its wording, following the HHS provider model revised in February 2026.

HHS also confirms that a federal court's June 18, 2025 order vacated the separate reproductive-health, attestation, and redisclosure NPP provisions formerly codified at 45 CFR 164.520(b)(1)(ii)(F), (G), and (H). This generator does not present those vacated provisions as current requirements. Review the current HHS fact sheet and the February 2026 HHS provider model before finalizing a notice.

The rights section must explain that individuals can inspect and copy their records, request amendments, receive an accounting of certain disclosures, request restrictions, request confidential communications, and obtain a paper copy of the notice on demand. The notice must describe the organization's legal duties, explain that it reserves the right to change its terms and how patients will learn of changes, tell patients how to complain both to the organization and to the Secretary of Health and Human Services with an assurance of no retaliation, name a contact person or office with a phone number, and carry an effective date. A fundraising statement is required if the entity intends to contact individuals for fundraising, including the right to opt out. The generator also offers optional practice-specific statements for reminders and electronic exchange.

Delivery, posting, and the acknowledgment signature

A direct-treatment provider must give the notice to each individual no later than the first service delivery, which in an emergency means as soon as reasonably practicable afterward. The full notice must be posted in a clear and prominent location at a physical service-delivery site and available there on request. A covered entity that maintains a website with information about customer services or benefits must prominently post the notice and make it available electronically. For a first service delivered electronically, the provider must provide electronic notice automatically and contemporaneously in response to the first request for service. Individuals retain the right to a paper copy.

Direct-treatment providers must make a good faith effort to obtain the patient's written acknowledgment that the notice was received, and when they cannot, they document the effort and the reason. A patient who declines to sign can still receive treatment. The acknowledgment is not a consent form; the patient is confirming receipt, not agreeing to the notice. Keep the signed acknowledgments, or the documentation of the attempts, for six years, the same retention period that applies to the notice itself and to your other HIPAA documentation.

When practices materially change their privacy practices, the notice must be revised first, because the organization may not implement a material change before the effective date of the notice that describes it. Providers then post the revised notice and make it available on request; they do not need to mail it to every past patient. Health plans have different website, annual-mailing, and distribution rules for material revisions.

How to review an older notice

An older notice should be compared element by element with the current rule and the organization's practices. Check the required header, uses and disclosures, rights, duties, complaint and contact information, effective date, the 2013 Omnibus changes, and the Part 2 statement required as of February 16, 2026. An old effective date alone does not prove a defect, and a new date alone does not make a notice accurate.

When a revision is needed, have counsel confirm the federal and state-law language, use an effective date that is not earlier than publication, update each required posting and distribution channel, retain the prior and revised notices, and brief the staff responsible for acknowledgments and individual-rights requests.

Notice, privacy policy, consent: three documents, three jobs

The notice of privacy practices has a different job from two neighboring documents. A website privacy policy describes what data a site collects from visitors, cookies included, and is governed by consumer protection and state privacy law, not by 45 CFR 164.520. A patient can be covered by both documents at once, and neither substitutes for the other; a healthcare website may also need a privacy policy under other applicable laws. Consent and authorization forms are different again. Treatment, payment, and operations require no signed permission under HIPAA, which is precisely what the notice explains. Written authorization is reserved for the uses the rule fences off, such as most marketing, sale of information, and most disclosures of psychotherapy notes. The notice describes the boundary; the authorization form is how a patient crosses it for a specific purpose.

State law sits on top of all of this. Several states require additional disclosures, shorter response deadlines for record requests, or stronger protections for categories like mental health, substance use, HIV, and genetic information, and federal rules at 42 CFR Part 2 add another layer for substance use disorder records. More stringent state privacy requirements can apply alongside HIPAA. That is one reason the draft should pass through counsel: this tool does not determine which federal or state requirements govern the organization.

Connect the notice to operational workflows

Each right described in the notice needs an operational workflow. Records access requires intake, identity verification, review, response, and fee controls. A self-pay restriction needs coordination between clinical and billing systems. Breach notification duties need an escalation path that reaches the people responsible for incident analysis and notice.

Generate the notice, have counsel adapt it, and train workforce members on the tasks that apply to their roles. USA HIPAA courses include a graded assessment and issue a dated certificate after a passing score. Organization plans provide seat management and completion records for team training. Training supports these workflows but does not replace policies, safeguards, legal review, or full compliance.