What Is an NPP Under HIPAA?
The patient-facing document every covered entity must provide under 45 CFR § 164.520.
Read more →Plain-language guides on HIPAA Notices of Privacy Practices — requirements, Part 2 SUD integration, state-law overlays, and OCR enforcement trends.
The HHS deadline passed Feb 16, 2026. Most practices haven't updated yet. These are the most-requested resources for practices catching up.
What happens now, what OCR is doing, and how to catch up in 5 minutes.
Start here30-minute action plan: what to skip, what to prioritize, audit-ready by week's end.
$137–$68,928 per violation, four-tier culpability structure, when CMP vs. resolution agreement.
What auditors look for, what triggers an audit, six-question audit-readiness self-check.
Why backdating is the wrong move; how to dating effective and supersede correctly post-deadline.
Direct-treatment vs. health plan distribution rules, acknowledgment forms, Section 1557 taglines.
2024–2025 OCR resolution agreements: settlement patterns, prompt-remediation evidence.
Part 2 programs faced a dual deadline. Combined HIPAA + Part 2 integrated notice path.
Start here. What an NPP is, what HHS requires in 2026, and how it differs from related documents.
The patient-facing document every covered entity must provide under 45 CFR § 164.520.
Read more →What a HIPAA Notice of Privacy Practices must contain in 2026, end to end.
Read more →Every section of the revised model, with what changed in 2024.
Read more →Two HIPAA documents, two different purposes. When you need each.
Read more →CA, NY, MA, WA: state-law overlays on top of HIPAA's federal floor.
Read more →Integrating 42 CFR Part 2 substance use disorder language into your NPP.
Read more →Practical guides to distributing, posting, and maintaining your NPP day to day.
Where to link, HTML vs. PDF, and how to keep it current after revisions.
Read more →In-person, telehealth, digital intake. How to provide and document delivery correctly.
Read more →What 45 CFR § 164.520 requires on your public site.
Read more →What the "good-faith attempt" rule actually requires you to do.
Read more →You can't deny treatment. What HIPAA requires and how to document the refusal.
Read more →How to handle dates correctly during material-change redistributions.
Read more →The six material-change triggers under § 164.520(b)(3) plus redistribution rules.
Read more →What counts as material, when redistribution is required, how to notify patients.
Read more →Asset vs. stock purchase, when to issue a new NPP, due diligence checklist.
Read more →Specialty-specific NPP guidance covering the practice types HIPAA covered entities most often need.
Psychotherapy notes, minor consent, and Part 2 considerations for mental health practices.
Read more →Solo dentists, group practices, and DSO-affiliated offices.
Read more →Distribution and acknowledgment for fully-virtual or hybrid practices.
Read more →Solo and small group physician practices. Lean compliance approach.
Read more →Federally Qualified Health Centers, Section 1557, sliding-fee context.
Read more →Retail and specialty pharmacy NPP requirements under HIPAA.
Read more →Parents as personal representatives, minors' rights, and what changes at 18.
Read more →Why most cash-only practices are still covered entities. The narrow exemption.
Read more →One NPP for all sites or per-location. The affiliated covered entity option.
Read more →State-specific NPP guidance for states with stricter-than-federal privacy laws.
CMIA's stricter confidentiality plus CCPA personal-information overlay.
Read more →SHIELD Act requirements for any practice serving NY residents.
Read more →WISP requirements, encryption rules, and breach-notification overlap.
Read more →Texas Medical Records Privacy Act and state-specific provisions.
Read more →FIPA's 30-day breach window and how it interacts with HIPAA.
Read more →Washington's My Health My Data Act and consumer health data scope.
Read more →Does your EHR or platform produce your NPP? Short answer: usually not. Here's what they do and don't include.
Epic signs a BAA and provides infrastructure but does not produce your practice's NPP.
Read more →athenaOne signs a BAA. The HIPAA NPP remains your practice's obligation.
Read more →No. What SimplePractice does and does not include for HIPAA compliance.
Read more →TherapyNotes signs a BAA but does not produce your practice's NPP.
Read more →eCW signs a BAA. HIE participation adds extra disclosure requirements.
Read more →Jane App is Canadian-built. US customers get a BAA but the NPP is on you.
Read more →Cerner / Oracle DrChrono Kareo / Tebra Tebra CharmHealth Elation Health Greenway Health MEDITECH NextGen Practice Fusion TheraNest Valant Veradigm / Allscripts
What OCR enforces against, what the penalties look like, and how to stay clear.
Civil monetary penalty ranges, common triggers, and tier breakdowns.
Read more →Real OCR enforcement actions and what each settlement teaches us.
Read more →How OCR investigates web-posting failures and the documentation that helps.
Read more →OCR's view on first-visit distribution and acknowledgment-of-receipt.
Read more →When buyers inherit a non-compliant NPP and what OCR has done about it.
Read more →Every practice-type vertical we cover.