Updating an existing NPP or creating a new one — we do both in one flow. HHS February 2026 model with Part 2 SUD language and optional Section 1557 taglines. Clean PDF and editable Word. $49 one-time.
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
You have the right to get a copy of your health record, ask us to correct it, get a list of those with whom we've shared it, and request confidential communications.
We are required by law to maintain the privacy and security of your protected health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
Three steps. No account required for the preview. Clean PDF and editable Word delivered in under five minutes.
Direct-treatment provider, health plan, 42 CFR Part 2 program, or combined HIPAA + Part 2 entity. The wizard tailors clauses to your entity type. HIE participation is a separate optional flag.
Organization name, address, Privacy Officer, website URL, effective date. Optional: Section 1557 taglines appendix, distribution channels. Chat or structured form — your choice.
See your NPP live in the browser. Download a free watermarked sample-data preview, or pay $49 to unlock the clean PDF and editable Word file.
Whether you're a solo therapist, a group dental practice, a mental-health clinic, or a telehealth platform — you need a HIPAA Notice of Privacy Practices.
LCSWs, psychologists, counselors, and solo mental-health practitioners. Includes Part 2 language when applicable.
Solo dentists, group practices, and DSO-affiliated offices. HIPAA covered entity if you file insurance claims electronically.
Behavioral-health organizations and SUD treatment programs. Combined HIPAA + Part 2 integrated notice supported.
Solo physicians, nurse practitioners, chiropractors, concierge medicine, and small group practices.
Virtual-care providers and remote patient monitoring. Language disclosing PHI flows through video platforms and EHRs.
Read our blog for entity-specific guides, Part 2 integration, state-law overlays, and OCR enforcement trends.
Free to preview. $49 one-time to download.
Sample data, watermarked. Not executable.
Clean PDF + editable Word. Your data.
An NPP is the patient-facing document every HIPAA covered entity must make available under 45 CFR § 164.520 — distributed at first service delivery, posted on the website, and posted at physical service sites. It describes uses and disclosures of PHI, individual rights, and covered-entity duties.
Both paths work, and we support both in one flow. If your practice already has an NPP that predates the HHS February 2026 revised model, you need an updated notice — the revised model integrates 42 CFR Part 2 SUD language and clarifies reproductive-health disclosures, and the compliance deadline was February 16, 2026. The output is a complete revised NPP with a "This notice supersedes our prior Notice of Privacy Practices dated X" line at the top so patients know which version is current. $49 whether you're updating or starting fresh.
Under § 164.520(b)(3): new uses or disclosures of PHI, change of Privacy Officer, change of organization address, significant safeguard-practice changes, individual-rights procedure changes, and mergers or acquisitions. Adopting the HHS February 2026 revised model (Part 2 integration, reproductive-health clarifications) is itself a material change. Direct-treatment providers must post the revised notice on the website and at physical sites and provide it to patients at their next visit; health plans must provide the revised notice to plan members within 60 days.
The revision integrates the 2024 Part 2 Final Rule — substance use disorder record protections are now reflected in a single combined HIPAA/Part 2 notice where applicable. It also clarifies reproductive-health PHI disclosures and individual-rights request language. The compliance deadline was February 16, 2026.
Yes — any HIPAA covered entity, regardless of size. If you transmit health information electronically in a standard transaction (e.g., submit claims electronically), you are a covered entity and § 164.520 applies.
Part 2 applies to federally-assisted programs holding themselves out as providing SUD diagnosis, treatment, or referral. Specialty SUD treatment programs are clearly in scope. Primary-care practices that screen for SUD without specializing are generally not.
Section 1557 of the Affordable Care Act requires covered programs to include taglines in the top 15 non-English languages of their service area, plus notices of availability of auxiliary aids and services. NPP Generator includes an optional Section 1557 taglines appendix.
Civil monetary penalties under HHS OCR range from $137 to $68,928 per violation (2024 adjusted amounts), with annual caps approaching $2 million for repeated violations. OCR actively investigates NPP deficiencies during audits and in the course of breach investigations.
Only on material changes per § 164.520(b)(3). New uses/disclosures, new Privacy Officer, mergers, relocation — yes. Typo fixes and non-material updates — no.
HHS publishes unformatted plain-text templates that you must manually customize. NPP Generator captures entity-specific details via guided intake and produces a formatted, signable PDF plus editable Word — including Part 2 additions and optional Section 1557 taglines — in under five minutes.
No. NPP Generator is not a law firm. For state-law overlays (CA, NY, MA), multi-state operations, or active OCR enforcement, we recommend healthcare counsel review before distribution. See our About page for methodology and limitations.
Guides and explainers on HIPAA NPP requirements.
HHS Feb 2026 model · Part 2 SUD language · Section 1557 taglines · $49 one-time · whether you're updating or starting fresh
Not sure if your practice needs one? Find out in 30 seconds →