What Must Be Included in a Notice of Privacy Practices?

A HIPAA Notice of Privacy Practices must include a prescribed header, a description of how the provider or health plan uses and shares protected health information, a statement of the patient’s rights, the provider’s legal duties (including breach notification), instructions for filing a complaint, and administrative details such as an effective date. Federal regulations at 45 CFR 164.520 set out every required element, and omitting any of them puts the provider out of compliance.¹ What follows is each required piece, in the order it typically appears in a compliant notice.

The Prescribed Header

The notice must display specific language prominently at the top: “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”¹ This is one of the rare places where the regulation dictates exact wording. The header can be a standalone heading or otherwise prominently displayed, but the words themselves are non-negotiable.

Uses and Disclosures That Do Not Require Authorization

The largest section of the notice describes how the provider or health plan uses and shares protected health information without needing the patient’s written permission. Vague generalities don’t satisfy the regulation.

Treatment, Payment, and Healthcare Operations

Each of the three routine-use categories must be described, and each must be illustrated with at least one concrete example.¹ Sharing a medical history with a specialist coordinating care is treatment. Submitting a claim to an insurer is payment. Using patient data in the aggregate to improve safety protocols is healthcare operations.² Category labels alone are not enough; examples are required.

Other Permitted Disclosures

Beyond routine care and billing, the notice must describe every other situation in which information may be shared without asking first. These include disclosures required or permitted by law, such as:

Public health activities, including reporting communicable diseases or suspected abuse.
Judicial and law enforcement purposes, such as responding to a court order.
Research use approved by an institutional review board.
Organ donation and disclosures to coroners or medical examiners.
Workers’ compensation claim processing.

Each category must be described with enough detail that a patient understands what could happen with their information.³ The notice must also warn that information disclosed under these provisions may be redisclosed by the recipient and would no longer be protected by HIPAA.¹

Separate Statements for Fundraising and Underwriting

If the provider intends to contact patients for fundraising, the notice must include a distinct statement saying so. The same rule applies to health plans that use information for underwriting. These statements cannot be folded into the general disclosure paragraphs; they must stand apart so patients actually see them.¹

Uses That Require Written Authorization

The notice must identify the categories of use that require the patient’s written authorization before they occur. The regulation specifically names marketing uses, any sale of protected health information, and most disclosures of psychotherapy notes.⁴ Narrow exceptions exist for psychotherapy notes, such as a therapist using their own notes to treat the patient, but outside those carve-outs authorization is mandatory.

Two additional statements go here. First, that any use or disclosure not otherwise described in the notice will occur only with written authorization. Second, that the patient may revoke an authorization at any time.¹ The revocation statement is easy to forget and explicitly required.

Individual Rights

The notice must lay out each right a patient has over their health information and explain how to exercise it.

Access and Copies

Patients have the right to inspect and receive a copy of their information in the designated record set, which includes medical and billing records. This right lasts as long as the provider maintains the records, with limited exceptions for psychotherapy notes and information compiled for legal proceedings.⁵ Reasonable fees are allowed. For electronic records requested in electronic format, HHS guidance permits either a flat fee not exceeding $6.50 or a calculation of actual costs.⁶

Amendments

Patients can request corrections to records they believe are wrong or incomplete. A provider may require the request in writing and ask for a supporting reason, but only if it tells patients about those requirements up front. A request can be denied if the information is accurate and complete, and the denial must be explained in writing.⁷

Accounting of Disclosures

Patients can request a log of who received their information over the past six years. The accounting covers disclosures made for purposes other than treatment, payment, and healthcare operations.⁸ So a patient won’t see every time their chart was shared between doctors, but they will see disclosures to public health authorities, researchers, or law enforcement.

Restrictions and Confidential Communications

Patients can ask the provider to limit how information is used for treatment, payment, or operations, or to restrict what is shared with family members involved in their care.⁹ The provider need not agree to most requests, but the notice must inform patients of the right to ask. Patients can also request confidential communications, such as receiving appointment reminders at a specific address or phone number.

Right to a Paper Copy

Even if a patient agreed to receive the notice electronically, they keep the right to request a paper copy at any time, and the notice must say so explicitly.¹

Provider Duties and Breach Notification

The notice must state that the provider is legally required to maintain the privacy of health information, to give patients this notice, and to abide by the terms of whichever version is currently in effect.¹⁰ That commitment is enforceable. If a provider later acts inconsistently with its own notice, that itself is a HIPAA violation.

The notice must also describe the provider’s duty to notify patients following a breach of unsecured health information. Federal rules require notification within 60 days of discovering the breach, with a description of what happened, what information was involved, and what steps the patient should take to protect themselves.¹¹

Complaint Contact and Anti-Retaliation Statement

The notice must name a specific contact person or office for questions and complaints. It must inform patients of their right to file a complaint directly with the U.S. Department of Health and Human Services, and it must state clearly that filing a complaint will not result in retaliation.¹² The no-retaliation assurance matters because patients understandably worry about jeopardizing their care by raising concerns.

Effective Date and Right to Change the Notice

The notice must show a clear effective date, so patients know which version applies.¹⁰ It must include a statement reserving the right to change the notice’s terms and explaining that any change will apply to all health information the provider already holds, not just to information created after the revision.¹ The notice must also tell patients how to obtain the revised version once a change is made.

Providers must retain copies of the notice, and of signed acknowledgments of receipt, for at least six years from the date of creation or the date last in effect, whichever is later.

Substance Use Disorder Records

A 2024 final rule aligned the federal privacy protections for substance use disorder treatment records (previously governed separately under 42 CFR Part 2) with HIPAA’s Notice of Privacy Practices requirements.¹³ For providers that maintain substance use disorder records, the notice must now reflect the stricter protections that apply to those records. Where Part 2’s rules are more protective than HIPAA’s general rules for a particular use or disclosure, the notice must describe the tighter restriction rather than the broader HIPAA permission.¹ The compliance deadline for these amendments is February 16, 2026.

What Is No Longer Required: Reproductive Health Provisions

The 2024 HIPAA Privacy Rule also included amendments related to reproductive health privacy that would have added specific NPP content. A federal court in the Northern District of Texas vacated those reproductive health provisions in June 2025, so providers are not required to include those statements. The non-reproductive-health amendments from the same rule, including the Part 2 alignment described above, remain in effect.

1
eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information
2
eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
3
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
4
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access
7
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
8
eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information
9
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
10
U.S. Department of Health and Human Services. Notice of Privacy Practices for Protected Health Information
11
U.S. Department of Health and Human Services. Breach Notification Rule
12
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
13
U.S. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule