The free HHS model NPP: what it covers, what it doesn’t
Yes: the HHS model Notice of Privacy Practices is free, published by OCR itself, and a legitimate notice to start from. What it does not do is fill in your practice specifics, produce the acknowledgment-of-receipt form and workflow that 45 CFR 164.520(c)(2)(ii) expects, or cover the other documents a covered practice must keep.
Last verified: July 15, 2026 · checked against the current 45 CFR 164.520 text
HHS model NPP vs. the $49 wizard vs. the $129 binder
An honest comparison. The free model is OCR’s own template and it is genuinely fine at what it is: unlike many samples circulating online, it is not a pre-2013 relic. The differences are in what you still have to build around it.
| What you need | Free HHS model | $49 NPP wizard | $129 Complete Binder |
|---|---|---|---|
| What it costs | Free. | $49 one-time, and it counts toward the Complete Binder. | $129 one-time. |
| Customized to your practice (name, profession, state, contact block) | No. It is a fill-in-the-blank template: OCR says to tailor it to your practice, and every bracket is yours to complete. | Yes. Built from your answers: practice name, profession, state, privacy contact, effective date, with profession-specific plain language. | Yes, and the same practice details drive the other eight documents. |
| Required statements under § 164.520(b) present | Yes. It is OCR's own template. Keeping the required statements intact while you edit is on you; the all-caps header sentence, for one, is required word for word. | Yes, generated in place, and the annotated copy cites the rule each section satisfies so you can check any of it. | Yes: the same generated notice, plus a plain-language summary for patients. |
| Acknowledgment of receipt: form + workflow (§ 164.520(c)(2)(ii)) | Not included. The model is the notice itself; the acknowledgment form, the good-faith-effort documentation, and the posting routine are yours to build. | Partly. The annotated copy includes the full distribution checklist (provide by first service, post, document acknowledgments); the acknowledgment form itself ships with the binder. | Yes. Print-ready acknowledgment-of-receipt form, with the notice and summary. |
| Editable Word + print-ready + annotated variants | Several layouts you adapt yourself. No annotated variant mapping each section to the rule that requires it. | All three: clean print-ready PDF, annotated PDF with citations, editable Word. | All three formats, for every document in the binder. |
| The other eight binder documents (BAA, risk analysis, policies, breach procedure, training log) | No. HHS publishes some free pieces separately (sample BAA provisions, a security risk assessment tool); finding, assembling, and adapting them is the real project. | No. The notice only. | Yes. All nine documents, built to order for your practice. |
If you are comfortable carefully editing a federal template and the notice is truly all you need, use the free model; that is what it is for. The paid versions buy you the filling-in, the citations to check the work, and (with the binder) the eight documents the model was never meant to include. See exactly what goes in a HIPAA binder.
Is the free HHS notice of privacy practices enough to be compliant?
No, and not because the model is deficient. The notice is one document in a larger required set. 45 CFR 164.530 separately requires a designated privacy official, workforce training, safeguards, a complaint process, a sanctions policy, and written policies and procedures, with the documentation retained for six years; 164.502(e) requires business associate agreements with vendors that touch patient data; and the Security Rule requires a documented risk analysis. A perfect notice with none of that behind it is one required document out of roughly nine.
Do patients have to sign the NPP?
No. Nothing in HIPAA requires a patient to sign the notice. What 45 CFR 164.520(c)(2)(ii) requires of a provider with a direct treatment relationship is a good-faith effort to obtain the patient's written acknowledgment of receipt, and, if it isn't obtained, documentation of the effort and the reason. The rule itself contemplates refusal: you document it and treat the patient normally. You must also keep copies available at your office, post the notice prominently on site, and post it prominently on your website if the site describes your services.
Does the HHS model NPP need to be updated for 2026?
For most private practices, no. The 2024 reproductive-health NPP amendments were vacated nationwide in Purl v. HHS (June 2025), so no reproductive-health update is required. The Part 2 amendments that survived carry a February 16, 2026 compliance date but are conditional: they bind covered entities that are Part 2 substance use disorder programs or that create, receive, or maintain records from one. OCR refreshed its model notices alongside that date, including a model Part 2 patient notice, so the current models reflect the current rules. If a generator is telling you every practice had to update by February 2026, that claim is wrong.
The full 2026 rundown, including what got vacated and what actually goes wrong in most notices: do you need to update your NPP for the 2026 rules?
See your finished notice before you pay anything
Answer a few questions about your practice, never about patients, and watch the notice fill in as you go, every section citing the rule that requires it. Reading it is free; $49 unlocks the clean PDF, the annotated PDF, and the editable Word file, and counts toward the Complete Binder.
Generate your NPPNeed the whole document set, not just the notice? See the Complete Binder.
Sources
- www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html
- www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520
- www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
Last verified July 15, 2026. Educational self-help information, not legal advice, and not affiliated with or endorsed by HHS. The HHS model notices are federal government works available to everyone free of charge; nothing here suggests otherwise. Whether HIPAA applies to your practice depends on the covered-entity test; state law may add stronger requirements. For advice specific to your situation, consult a qualified attorney.
Every required document, done for you
The complete nine-document binder, built to order for your practice and state, with every policy citing the rule that requires it.
See the binder and pricing