45 CFR § 164.520
Notice of privacy practices for protected health information
The Notice of Privacy Practices rule, including the exact header it must carry.
Read the full official text on eCFRResearched and written by Larry Osakwe · Last verified August 4, 2026
Checked against 45 CFR 164.520 via eCFR. Not a lawyer, not a certified compliance professional, and not affiliated with HHS.
What 164.520 actually says
This is the section behind the notice you hand patients and post in your office. It is unusually prescriptive: it specifies content, distribution, posting and revision, and it dictates one piece of text verbatim.
That verbatim header is the fastest way to check any notice, including one you paid for. If the capitalised statement below is not on it, prominently displayed, the notice does not comply.
The paragraphs above are our plain-English reading. The blocks below are quoted verbatim from the regulation.
The text that matters
must contain the following statement as a header or otherwise prominently displayed: “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”
The notice must contain: (A) A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by this subpart to make for each of the following purposes: treatment, payment, and health care operations.
Quoted from 45 CFR § 164.520. US federal regulations are not subject to copyright. Retrieved from eCFR and last checked August 4, 2026.
What this section means you must hold
The regulation states obligations. This is the paperwork those obligations translate into, which is the part the regulation itself leaves you to work out.
| The obligation | What you produce for it |
|---|---|
| Maintain a compliant notice, and give it to patients | Your Notice of Privacy Practices |
| Document a good-faith effort to obtain written acknowledgment of receipt | An acknowledgment form in the intake packet, retained on file |
| Post it prominently in the practice and publish it on your site | The posted copy, and a web page. A notice that exists only in a drawer fails the posting requirement. |
Where practices get 164.520 wrong
Downloading the HHS model notice and filing it. The model is a starting point, not a finished document: it still needs your practice's details, your contact for complaints, and any state-law provisions that are more protective than HIPAA. The other frequent miss is the acknowledgment, which is a separate obligation from the notice itself.
Other sections people look up
45 CFR § 160.103
Definitions
45 CFR § 164.504(e)
Uses and disclosures: Organizational requirements
45 CFR § 164.308
Administrative safeguards
45 CFR § 164.508
Uses and disclosures for which an authorization is required
Educational summaries of federal regulations, not legal advice and not a determination about any specific practice. Where our reading and the regulation differ, the regulation controls; the eCFR link above is authoritative.
Get every document, done for you
Preview the binder free. Your binder is built to order and delivered within 30 days, with a full refund anytime before then.
See the binder and pricing