Notice of Privacy Practices, explained
An educational explainer of what a HIPAA Notice of Privacy Practices (NPP) is and what it commonly includes. Not a template to adopt; have your notice drafted or reviewed by counsel.
Current as of July 7, 2026. Laws, payer rules, and billing codes change, so confirm the current requirements for your jurisdiction and setting before you rely on it.
What's inside
What it is
The Privacy Rule generally requires covered health care providers to give patients a Notice of Privacy Practices describing how their health information may be used and shared and what rights they have.
What it commonly describes
- How the practice may use and disclose protected health information for treatment, payment, and operations
- Uses that need the patient's authorization
- Patient rights: to access, request amendments, get an accounting of disclosures, request restrictions, and file a complaint
- The practice's duties, a contact for questions, and the effective date
How it is used
Practices generally provide the notice at the first service, make a good-faith effort to obtain written acknowledgment, post it, and make it available on request. Confirm the current requirements and adapt to your setting with counsel.
About this resource
This reference is part of the shrinkiatry resource library, a set of free, clinician-facing references and examples. It's reviewed by Shariq Refai, MD, MBA, FAPA, a board-certified psychiatrist, on a quarterly schedule. Next scheduled review: October 1, 2026. First published July 7, 2026, last reviewed July 7, 2026.
Browse the rest of the resource library, or verify who reviews this site. Spotted something out of date? Email corrections@shrinkiatry.com.