Notice of Privacy Practices (NPP)

A Notice of Privacy Practices tells patients how a practice may use and share their health information and what rights they have over it. The notice does not grant permission for anything. The front desk hands it out, asks for a signed acknowledgment of receipt, and documents the attempt. A patient's signature confirms receipt only. It is not consent.

What is a Notice of Privacy Practices?

A Notice of Privacy Practices (NPP) is a written notice that explains how a health care organization may use and disclose a patient's protected health information (PHI), what rights the patient has, and how to exercise them. HIPAA requires every covered entity to issue one. Covered entities are health care providers that bill electronically, health plans and health care clearinghouses, and clearinghouses have a limited exception. The audience is patients, not staff or lawyers, so it should be written in plain language.

In practice at a clinic or small practice

Front desk. At a new patient's first visit, give them the NPP and ask them to sign an acknowledgment that they received it. If the patient declines, write down that they refused and what you did to get the signature, for example "offered at check-in, patient declined to sign." Then continue check-in as usual. You can answer simple questions, such as "What is this?" or "Do I have to sign?" Refer privacy requests to the privacy contact named in the notice. These include restriction requests, requests for a copy of records, and complaints.

Office manager or privacy officer. Keep one current version of the notice. Typical upkeep looks like this:

• Post it in the waiting area and on the practice website.
• Give a copy to anyone who asks.
• When the notice is revised, replace the old copies at every location, on the clipboard and online.
• Keep prior versions on file.
• Brief staff on what changed.

Staff will raise NPP questions with each other, such as "A patient wants to restrict disclosures to her insurer. Who handles that?" Those conversations belong in the practice's approved internal channels, such as a HIPAA-compliant chat for staff covered by a business associate agreement. They should not happen in personal text threads. If you are unsure how a specific request should be handled, check with your privacy officer or counsel.

Not to be confused with

Term	What it is	How it differs from the NPP
Authorization	The patient's signed permission for uses the notice says require one, such as certain marketing uses	The NPP only informs and needs no permission. Signing the acknowledgment authorizes nothing. See HIPAA authorization vs consent.
Website privacy policy	Covers website visitors, cookies and online data collection	The NPP covers PHI under HIPAA. A practice may need both, and one does not replace the other.
Business associate agreement	A contract between the practice and a vendor that handles PHI	The BAA governs the vendor relationship. The NPP is written for patients.

What the rules say

• Primary source: the HIPAA Privacy Rule at 45 CFR 164.520, plus HHS Office for Civil Rights (OCR) guidance and model notices.
• Required content, in plain English:
  • a prescribed header statement
  • how PHI may be used and disclosed
  • patient rights: access, amendment, an accounting of disclosures, requesting restrictions, confidential communications, and a paper copy of the notice
  • the practice's legal duties
  • how to file a complaint with the practice and with HHS
  • a contact person
  • an effective date
• Timing: providers with a direct treatment relationship give the notice at the first service delivery, or as soon as practicable after an emergency. Health plans have their own distribution duties, including a periodic reminder that the notice is available.
• Revisions: when practices change in a material way, the notice must be updated and redistributed or posted, and prior versions must be retained.
• Recent changes: NPP content changes have been tied to the 42 CFR Part 2 alignment rule and to the 2024 reproductive health privacy rule. The reproductive health rule has since been challenged in court, which may affect whether its NPP provisions apply. Confirm the current requirements with your privacy officer or counsel before you revise your notice.

Related reading

• HIPAA Privacy Rule
• HIPAA authorization vs consent
• Protected health information (PHI)

More terms in the Healthcare operations glossary.