Policy required document Healthcare
Notice of Privacy Practices
The Notice of Privacy Practices is the patient-facing document a HIPAA covered entity must publish and hand out. It explains how the organization may use and disclose health information, the patient's rights, the organization's legal duties, and how to complain.
The Privacy Rule fixes the header language, the required content, and the delivery rules: providers give it at the first service, post it in the facility and on the website, and make a good-faith effort to get a written acknowledgment of receipt.
Since February 16, 2026, every HIPAA NPP must also tell patients that substance use disorder treatment records protected by 42 CFR Part 2 may not be used against them in civil, criminal, administrative or legislative proceedings without consent or a court order.
Part 2 programs have a parallel patient notice under 42 CFR 2.22, and HHS published a model that lets a program that is also a covered entity issue one combined notice.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| HIPAA Privacy Rule, notice of privacy practices 45 CFR 164.520 | You are a covered entity other than the excepted cases in 164.520(a)(2) and (3) | A plain-language notice with the prescribed header, uses and disclosures, patient rights, covered entity duties, complaint route, contact, and effective date; delivered, posted, and revised when practices change. Legally required. | Mandatory |
| HIPAA Privacy Rule, acknowledgment of receipt 45 CFR 164.520(c)(2)(ii) | You are a provider with a direct treatment relationship | Good-faith effort to obtain written acknowledgment of receipt at first service delivery; if not obtained, document the effort and the reason. Legally required. | Mandatory |
| HIPAA NPP amendments for Part 2 records 89 FR 32976 (Apr 26, 2024), 164.520(b)(1)(ii)(F) and (v)(A), compliance Feb 16, 2026 | You are any covered entity | Statements that Part 2 records will not be used or disclosed in proceedings against the patient without consent or court order, and, for entities that hold Part 2 records, related content. This is the surviving portion of the 2024 rule after the Purl vacatur. Legally required. | Mandatory |
| 42 CFR Part 2, patient notice 42 CFR 2.22 | You are a federally assisted Part 2 program | At admission, inform the patient that federal law protects SUD records and provide a plain-language notice of legal duties and privacy practices, including each permitted disclosure without consent. Legally required; compliance date Feb 16, 2026 for the 2024 changes. | Mandatory |
| HHS model notices HHS OCR model NPPs, updated Feb 13, 2026 | Voluntary | Templates for providers, health plans, and Part 2 programs that incorporate the 2026 content. Using them is optional; the content requirements are not. | Market |
Required sections
- Prescribed header: this notice describes how medical information about you may be used and disclosed and how you can get access to this information (164.520(b)(1)(i))
- Uses and disclosures for treatment, payment and health care operations, with an example of each
- Other permitted and required uses and disclosures without authorization, in enough detail to notice each one
- Uses that require authorization: marketing, sale of PHI, psychotherapy notes where applicable
- Statement that Part 2 records will not be used in proceedings against the patient without consent or court order (from Feb 16, 2026)
- Patient rights: access, amendment, accounting, restriction, confidential communication, paper copy, breach notification
- Covered entity duties, including the duty to abide by the current notice and to notify of breaches
- Complaint procedure to the entity and to HHS, with a no-retaliation statement
- Contact person or office
- Effective date
- Fundraising and underwriting statements where the entity does them (single-source items)
- For Part 2 programs: the 2.22 elements, including the fact that violation is a crime and reports of a crime on program premises may be reported
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Who looks at it
Where this document gets checked.
No one certifies a document like this on its own. It is read during the audits and inspections below, and by the agency behind each rule.
| Where it is looked at | Who looks at it |
|---|---|
| 42 CFR Part 2 | HHS Office for Civil Rights investigates complaints and breaches and can impose civil money penalties; the Department of Justice can bring criminal cases. State licensing surveys and accreditors (CARF, Joint Commission) check Part 2 practices as part of broader surveys. There is no certification |
| HIPAA | Government enforcement only. OCR investigates complaints and breach reports, conducts compliance reviews and periodic audits, and can impose civil money penalties or resolution agreements; state attorneys general may also sue under HITECH. There is no HIPAA certification recognized by HHS; third-party assessments (including HITRUST) are voluntary |
Who helps write it
Consultants.
Firms that name these standards in their own material.
No firm has claimed a listing for this document yet. Claim yours →
Where it lives
Software.
Tools that hold documents like this one and record who has read them.
Need a hand implementing it?
Find a Consultant for Notice of Privacy Practices
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
Can one notice cover HIPAA and Part 2?
Yes. HHS says a combined notice is acceptable if it contains everything required by 164.520 and 2.22. The two lists differ enough that many programs keep the Part 2 notice separate to avoid a very long document.
Do I need a new signed acknowledgment from every existing patient after the 2026 change?
The rule requires the good-faith effort at first service delivery. A revised notice must be posted and available; re-collecting acknowledgments from existing patients is not required by the text. Verify with counsel for your state.
What if the patient refuses to sign?
Document the attempt and the reason. The rule asks for a good-faith effort, not a signature.
Do the reproductive health attestation forms still apply?
No. The court vacated the reproductive health rule in June 2025, including the attestation requirement. Only the Part 2 notice change survived.
Who owns this site?
AllyMatter, a policy management tool that may appear in listings on this page. It is labeled every time, excluded from picks, and receives nothing from the matching form unless you name it.