Who needs a notice of privacy practices
The NPP requirement applies to covered entities. A health care provider is a covered entity if it transmits health information electronically in connection with a standard transaction, such as submitting a claim or checking eligibility with a health plan (45 CFR 160.103). A therapist who bills insurance electronically, or uses a billing service that does it for them, is almost certainly covered. A cash‑only practice that never conducts those transactions may not be, though state law can still require a privacy notice, and many self‑pay practices give one anyway.
The NPP and the other privacy documents
| | |
|---|
Notice of privacy practices (this page) | Explains how information is used and shared, and the client's rights | No. You ask them to acknowledge receiving it |
Acknowledgment of receipt | Records that the client got the notice, or your good-faith effort to get that record | |
| Permits a specific release the rule doesn't otherwise allow | |
| Records agreement to therapy and its terms | |
See the HIPAA consent form template for authorizations and the consent form template for consent to therapy.
What the notice must contain
45 CFR 164.520(b)(1) lists the required content, and the notice has to be written in plain language (eCFR). In order:
| |
|---|
| This exact statement, prominently displayed: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY." |
| Treatment, payment and health care operations, each with at least one example; every other purpose the rule permits without authorization; and the uses that need written authorization, including most uses of psychotherapy notes |
| Where state or other law limits a use more than HIPAA does, the description must reflect that stricter law |
| To request restrictions, to confidential communications, to inspect and copy, to amend, to an accounting of disclosures, and to a paper copy of the notice |
| That you must protect the information, follow the notice, and notify clients after a breach of unsecured information; and whether you reserve the right to change the notice |
| How to complain to you and to the Secretary of HHS, and that you won't retaliate |
| The name or title and phone number of the person who answers privacy questions |
| The date the notice takes effect, which can't be earlier than the date it's printed or published |
The stricter‑law row matters for therapists. Many states restrict disclosures of mental health records more than HIPAA does, and a notice copied from a medical practice in another state can describe disclosures your state doesn't allow.
Sample NPP wording for a therapy practice
Harbor Lane Counseling is a fictional group practice. The excerpts below show the level of detail and the kind of examples a therapy notice can use. They are not a complete notice, and every practice has to fit the wording to its own state law and practices.
Header: THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Treatment: "We may share information with other professionals who are treating you. For example, with your knowledge, your therapist may talk with your psychiatrist about your medication and how you are doing in therapy."
Payment: "We may use and share information to get paid. For example, we send your health plan the dates of your sessions and your diagnosis so it can pay your claim."
Health care operations: "We may use information to run our practice. For example, a clinical supervisor may review your record to check the quality of care."
Psychotherapy notes: "Some therapists keep separate notes about the content of sessions. We will not use or share these notes without your written authorization, except in the limited situations the law allows."
Your right to restrict: "You may ask us not to share certain information. We don't have to agree, with one exception: if you pay for a service in full yourself, we must agree not to share information about that service with your health plan for payment or operations, unless the law requires it."
Questions and complaints: "Contact our privacy officer, [title], at [phone]. You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint."
Effective date: "This notice takes effect on [date]."
Blank notice of privacy practices outline
Use this outline to check a draft or to build your own. HHS publishes model notices you can start from instead (see the references).
- Required header in capital letters, word for word.
- Practice name and the locations the notice covers.
- How we use and share your information: treatment, payment and operations, one example each.
- Other uses allowed without your authorization: [the ones that apply to you, adjusted for stricter state law]
- Uses that need your written authorization: psychotherapy notes, marketing, sale of information, and anything not described in this notice; how to revoke an authorization.
- Your rights: restrictions (including the self-pay rule), confidential communications, access and copies, amendment, accounting of disclosures, a paper copy of this notice.
- Our duties: protecting your information, following this notice, breach notification, and whether we may change this notice and how you'll get the new one.
- Complaints: to us and to HHS; no retaliation.
- Contact: privacy officer title and phone.
- Effective date:
Giving the notice to clients
For a provider with a direct treatment relationship, 45 CFR 164.520(c) sets the delivery rules:
- Give the notice no later than the date of the first service, including a first session by video. In an emergency, give it as soon as reasonably practicable afterward.
- Except in an emergency, make a good-faith effort to get the client's written acknowledgment that they received it. If they don't sign, document your effort and the reason.
- Keep copies available at the office for anyone who asks, and post the notice in a clear and prominent place there.
- If your practice website describes your services, post the notice prominently on the website too.
- You may email the notice if the client agrees to electronic notice, and the client keeps the right to a paper copy.
Changing the notice
When you make a material change to how you use or share information, to clients' rights or to your duties, you must revise the notice and make it available. Except where the law requires it, the change can't take effect before the effective date of the revised notice (164.520(b)(3)). Keep each version you issued, and the signed acknowledgments or records of your efforts, for six years (45 CFR 164.530(j)).
HHS has amended 164.520 more than once since the original rule. Before you print a new notice, compare your draft with the current text on eCFR and with HHS's current model notices rather than relying on an older template, this one included.
Common NPP mistakes
- Rewording the header. It has to appear as the rule states it.
- Medical-practice examples, such as lab results and surgery, that mean nothing to a therapy client.
- No mention of psychotherapy notes, or of the self-pay restriction right.
- A notice describing disclosures your state's mental health law doesn't allow.
- Handing it out on paper but leaving it off the website.
- No acknowledgment, and no note of why a client didn't sign one.
Your NPP and AI note-taking
The required content in 164.520(b) doesn't include a list of your software vendors, so adding an AI scribe doesn't by itself mean rewriting the notice. What it does change is your vendor paperwork and your consent conversation: tell clients you use one, and record their choice. The AI therapy notes page explains how Twofold drafts notes from a session.
HIPAA consent form template, consent form template, telehealth consent form template, counseling intake form template and patient registration form template.
Reviewed and updated November 2026.
