Notice of Privacy Practices
NPP
The written notice covered entities must provide to patients describing how PHI may be used and disclosed and patient rights regarding PHI.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Acronym for
- NPP
- Primary sources
- 3
- Workspace handoff
- templates →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
45 CFR 164.520 requires covered entities to provide a Notice of Privacy Practices on the first date of service, post it in the office and on the website, and obtain a written acknowledgment of receipt. The notice must describe permitted uses, patient rights, and the entity's legal duties.
How it shows up in your practice
Update your NPP whenever your privacy practices change materially. Track acknowledgments — OCR audits routinely review NPP currency and acknowledgment logs.
Sources
- 45 CFR 164.530 — Privacy Rule administrative requirementshttps://www.ecfr.gov/current/title-45/section-164.530
- HHS — HIPAA Privacy Rulehttps://www.hhs.gov/hipaa/for-professionals/privacy/index.html
- HHS — Notice of Privacy Practiceshttps://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-for-protected-health-information/index.html
Pull the NPP template from the Templates engine
Open templates →Related terms
- HIPAA & PrivacyHIPAA Privacy RuleThe federal regulation at 45 CFR Part 164 Subpart E that governs the use and disclosure of PHI.
- HIPAA & PrivacyPatient Right of AccessThe HIPAA right of an individual to inspect and obtain a copy of their PHI in a designated record set.
- HIPAA & PrivacyAuthorization for DisclosureA written authorization signed by the individual permitting a covered entity to use or disclose PHI for a purpose not otherwise permitted by the Privacy Rule.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryAuthorization for DisclosureA written authorization signed by the individual permitting a covered entity to use or disclose PHI for a purpose not otherwise permitted by the Privacy Rule.
- GlossaryHIPAA Privacy RuleThe federal regulation at 45 CFR Part 164 Subpart E that governs the use and disclosure of PHI.
- GlossaryPatient Right of AccessThe HIPAA right of an individual to inspect and obtain a copy of their PHI in a designated record set.
- GlossaryJoint Notice (Privacy Practices)A single Notice of Privacy Practices used by multiple legally-separate covered entities operating as an Organized Health Care Arrangement.
- ComplianceHIPAA Privacy Officer: Required Duties + Job Description Template (2026)The 2026 HIPAA Privacy Officer role: what 45 CFR 164.530(a) requires, duties auditors look for, and a copy-paste job description for small practices.
- RegulationHIPAA Notice of Privacy Practices (45 CFR 164.520)Covered entities must provide a Notice of Privacy Practices describing how PHI may be used and disclosed and the individual's rights, with specific delivery and posting requirements.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.