Do I have to post my NPP online?

If you are a covered entity with a direct treatment relationship and you maintain a website that provides information about your services, 45 CFR 164.520 requires you to make the notice available on that site. You must also give it at first service and post it prominently in the office.

Can I just use the free HHS model notice?

You can start from it, but a model notice still has to reflect your actual uses and disclosures, current content requirements, and any stronger state law. It is the notice document only, not the acknowledgment form, policies, risk analysis, or the rest of the required set.

Do I need patients to sign the NPP?

You must make a good-faith effort to obtain a written acknowledgment of receipt from patients with a direct treatment relationship, and document the effort if you cannot. The signature acknowledges receipt of the notice; it is not consent to treatment or to every disclosure.

Notice of Privacy PracticesNPP

A Notice of Privacy Practices (NPP) is the document a covered entity must give patients describing how it uses and discloses their PHI and their rights over it. Under 45 CFR 164.520 the individual has a right to adequate notice, and providers with a direct treatment relationship must give it at first service, post it, and put it online.

45 CFR § 164.520Read the regulation on eCFR

Last verified: July 23, 2026

What NPP means under HIPAA

Section 164.520 is titled Notice of privacy practices for protected health information, and its general rule is a right: an individual has a right to adequate notice of the uses and disclosures of PHI a covered entity may make, and of the individual’s rights and the entity’s legal duties with respect to that information. The notice has required content, including how PHI is used for treatment, payment, and operations, the patient’s rights (access, amendment, accounting, restrictions), and how to complain.

For a provider with a direct treatment relationship, the rule adds distribution mechanics: give the notice at the date of first service, make a good-faith effort to get a written acknowledgment of receipt, post the notice prominently in the office, and, if you have a website that describes services, post it there. The acknowledgment is the piece practices most often forget to file.

The NPP is usually the first document a practice builds, because it is patient-facing and its absence is obvious. HHS publishes model notices, but a model notice is a starting point that still has to reflect your actual practice, your state’s stronger rules where they apply, and the current content requirements after the 2024–2026 reproductive-health-privacy and Part 2 changes.

Generate your Notice of Privacy Practices

Build a current, practice-specific NPP with the wizard and see the finished notice before you pay.

NPP FAQ

Related terms

PHI

45 CFR § 160.103

Covered Entity

45 CFR § 160.103

Minimum Necessary Standard

45 CFR § 164.502(b)

See every term in the HIPAA glossary.

Turn the vocabulary into the documents

Knowing the terms is step one. See the full document set a covered practice keeps, or generate the ones you can build yourself now.

See what goes in a HIPAA binder

Source

www.ecfr.gov/current/title-45/section-164.520

Last verified July 23, 2026. This definition is educational self-help information, not legal advice, and it paraphrases the regulation; the controlling text is 45 CFR § 164.520, linked above. Whether HIPAA applies to your practice depends on the covered-entity test. State law may add stronger requirements.