Description
HIPAA PRIVACY RULE | 45 CFR 164.520
Notice of Privacy Practices Template
Document ID: HEL-NPP-001 • Version 1.1
Every covered entity required to maintain a Notice of Privacy Practices under 45 CFR 164.520(a) must give patients adequate notice of how their protected health information may be used and disclosed, their individual rights, and the organization’s legal duties. It is one of the first documents OCR requests in a complaint investigation or compliance review, and as of February 16, 2026, notices must also reflect the substance use disorder alignment provisions of the 2024 Part 2 Final Rule. A notice that is missing required elements, still contains the reproductive health provisions vacated in Purl v. HHS, or has not been updated in years is an easy audit finding and a visible gap to any patient who reads it.
This template gives you a complete, customizable notice built section by section against every content requirement in 164.520(b)(1), from the mandated verbatim header statement through the individual rights section, duties, complaints, and contact information. A companion distribution and acknowledgment guide walks through the different timing and posting rules for providers under 164.520(c) and health plans under 164.520(d), and a 22-row regulatory crosswalk maps every notice section to its exact citation so your Privacy Officer can defend the document line by line in an audit. Optional sections address AI use disclosure, ambient scribe recording consent, and health information exchange participation, each flagged as state-law-driven rather than federally mandated so you customize only what applies.
What Is Included
Part A: Patient-Facing Notice
- Mandated verbatim header statement (45 CFR 164.520(b)(1)(i))
- Treatment, payment, and health care operations uses with required examples (164.520(b)(1)(ii)(A))
- Full permitted and required disclosure categories, including public health, law enforcement, and judicial proceedings (164.512)
- Authorization-required uses and revocation rights (164.520(b)(1)(ii)(E))
- Conditional statements for fundraising, group health plan sponsor disclosures, and underwriting (164.520(b)(1)(iii)(A)-(C))
- Substance use disorder records section aligned to the February 16, 2026 Part 2 requirements (164.520(b)(1)(iii)(D)-(E); 42 CFR 2.22)
- Complete individual rights section: access, amendment, accounting of disclosures, restrictions, and confidential communications, with all applicable 30-day extensions (164.522, 164.524, 164.526, 164.528)
- Duties, complaints, and contact information sections (164.520(b)(1)(v)-(viii))
Optional Emerging-Topic Sections
- AI use disclosure for clinical documentation and decision-support tools
- Ambient listening and AI scribe recording consent language
- Health information exchange participation and opt-out disclosure
Part B and Part C
- Distribution and acknowledgment guidance separated by provider and health plan requirements (164.520(c)-(e))
- 22-row regulatory crosswalk mapping every notice section to its exact citation for audit response
Document Controls
- Revision history table, approval and signature block
- Related documents table for cross-referencing your Patient Rights Policy and acknowledgment forms
Who This Is For
Privacy officers and practice managers at medical practices, dental offices, behavioral health providers, and health plans who need a compliant notice built from scratch or refreshed ahead of an OCR audit. Healthcare attorneys and compliance consultants drafting or reviewing NPPs for multiple covered entity clients will find the crosswalk especially useful for defending notice content during a complaint investigation or corrective action plan review.
This template is not a final notice until customized with your organization’s actual practices, reviewed by your Privacy Officer or legal counsel, and approved. Sections addressing AI use, ambient scribe recording, and health information exchange participation should be confirmed against your operating states before publication, since these are driven by state law rather than federal requirement.
Format: Microsoft Word (.docx), fully editable • Delivered as an instant digital download • Document ID: HEL-NPP-001
Reviews
There are no reviews yet.