HIPAA Notice of Privacy Practices (45 CFR 164.520)
Covered entities must provide a Notice of Privacy Practices describing how PHI may be used and disclosed and the individual's rights, with specific delivery and posting requirements.
Primary source
45 CFR 164.520 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.520 requires every covered entity (with limited exceptions for inmates and certain group health plans) to provide an individual a written Notice of Privacy Practices. The notice must describe permitted uses and disclosures, the individual's rights, the entity's duties, complaint procedures, and the effective date.
Direct treatment providers must provide the notice at first service delivery, make a good-faith effort to obtain written acknowledgment of receipt, post the notice prominently in the practice, and make it available on any website used to communicate with patients. Health plans deliver to enrollees at enrollment and then once every three years. Material changes trigger redistribution.
OCR publishes model notices in eight formats (full-page, layered, brochure; English and Spanish). Practices should benchmark against the model notices but tailor language to actual practice operations (uses for marketing, fundraising, research, etc.) — a notice that does not match real practice is a Privacy Rule violation in itself.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Treatment, Payment, and Operations (45 CFR 164.506)Covered entities may use and disclose PHI for treatment, payment, and health care operations without authorization, subject to limits and notice requirements.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Right of Access (45 CFR 164.524)Individuals have a right to inspect and obtain copies of their PHI in a designated record set, in the form and format requested when readily producible, within 30 days.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- GlossaryNotice of Privacy PracticesThe written notice covered entities must provide to patients describing how PHI may be used and disclosed and patient rights regarding PHI.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- ComplianceNotice of Privacy Practices (NPP) Template — 2026A 2026 Notice of Privacy Practices template aligned to 45 CFR 164.520, with every required header, the post-Dobbs reproductive-health content, and CMIA/HB 300 carveouts.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.