Does Veradigm (Allscripts) Provide a Notice of Privacy Practices?

By NPP Generator Research Team  ·  Published Apr 25, 2026  ·  Last reviewed Apr 28, 2026  ·  3 min read

Veradigm (formerly Allscripts) (formerly Allscripts) provides EHR and practice-management software for ambulatory practices and group practices. A common assumption among new Veradigm (formerly Allscripts) customers is that the platform's HIPAA-compliant infrastructure or BAA covers the NPP requirement. It does not. The NPP is a covered-entity-side document — your practice produces it, distributes it, and posts it.

What Veradigm (formerly Allscripts) does provide for HIPAA compliance

Veradigm (formerly Allscripts) provides HIPAA-compliant infrastructure and contractual protections, but none of them are an NPP:

• HIPAA-compliant infrastructure (Allscripts Professional EHR, TouchWorks, Sunrise)
• BAA on appropriate enterprise tiers
• Practice-customizable patient portal
• Document-template integration for practice-produced patient documents

Plan tiers and BAA availability

Veradigm offers tiered enterprise plans. The BAA is included on appropriate HIPAA-customer tiers and executed during onboarding.

How to request the BAA from Veradigm (formerly Allscripts)

Veradigm's BAA is executed during enterprise onboarding. Contact Veradigm's contracting team for the BAA.

What the Veradigm (formerly Allscripts) BAA covers (and doesn't)

The Veradigm (formerly Allscripts) BAA binds Veradigm (formerly Allscripts) to HIPAA's safeguard obligations for PHI it handles on your behalf. It does not produce an NPP, fulfill your NPP-distribution obligation, or substitute for any patient-facing HIPAA documentation. The BAA covers vendor-side responsibilities; the NPP covers practice-side patient communications.

Alternatives if you need NPP support

After Veradigm onboarding, produce an NPP using NPP Generator's tool ($49) or attorney-drafted, and integrate it into the Veradigm patient portal and your practice website.

Setup after enabling Veradigm (formerly Allscripts)'s HIPAA features

Configure Veradigm portal to deliver NPP at intake, post on practice website, and at physical locations. Re-distribute on material change.

Common patient-facing scenarios with Veradigm (formerly Allscripts)

In day-to-day operations using Veradigm (formerly Allscripts), several scenarios commonly surface NPP-related questions:

• New patient onboarding — present the practice's NPP at first encounter; capture acknowledgment electronically through the practice-management workflow
• Returning patients post-NPP-update — when the NPP materially changes, surface the updated NPP at the next encounter or via the patient portal
• Patient-portal NPP availability — make the NPP downloadable from the patient-portal documents area
• Right of Access requests — patients may request electronic copies of their records; the NPP describes this right and the practice's response process
• Vendor-relationship changes — if you switch from Veradigm (formerly Allscripts) to another EHR, the NPP may need updating to reflect the new vendor relationship

Audit-readiness with Veradigm (formerly Allscripts)

When OCR or a state regulator audits a practice using Veradigm (formerly Allscripts), expect the auditor to request:

• Signed BAA between the practice and Veradigm (formerly Allscripts)
• Practice-issued NPP (current version)
• Acknowledgment-tracking documentation
• Evidence of patient-portal NPP availability
• Documentation of any data exchanges between the practice and other vendors (each requires its own BAA)

What changed in the HHS February 2026 model

The HHS February 2026 final rule introduced several NPP content updates that affect every covered entity, including practices using Veradigm (formerly Allscripts): clarified Right of Access language, updated breach-notification provisions, refined marketing-communication requirements, and explicit safeguards-against-AI language. Practices issuing or updating NPPs after February 16, 2026 should align to the new model. Veradigm (formerly Allscripts)'s patient-portal infrastructure typically supports either model; the document content is the practice's responsibility.