NPP Effective Date vs. Supersede Date

How the effective date and supersede date work on a HIPAA Notice of Privacy Practices — when to use each, and how to handle material-change redistributions.

By NPP Generator Research Team  ·  Published Feb 25, 2026  ·  Last reviewed Apr 23, 2026

Why both dates matter

HIPAA requires every NPP to display the effective date prominently — 45 CFR § 164.520(b)(1)(i). When you publish a revised NPP, the new one needs an effective date. If it replaces a prior version, a supersede date is good practice to help patients understand which notice was in effect when.

Effective date

The effective date is the date the NPP takes effect — usually the date you publish it (or a later date if youre pre-publishing). Its prominently displayed at the top. For the revised HHS Feb 2026 model, the effective date is whenever you adopt the revised notice at your practice (typically the day you post the new NPP).

Supersede date

When you update your NPP, the new version supersedes the prior one. The supersede date is the date the prior NPP stopped being in effect — usually the same day the new one becomes effective. Its not strictly required by the regulation, but including it avoids confusion about which NPP was in place during any given visit.

When to update

HIPAA requires updating on any material change — new uses/disclosures, new Privacy Officer, mergers, change of location, significant change in safeguard practices. Non-material changes (typo fixes, phone-number updates) do not require redistribution.

Material change redistribution

Direct-treatment providers: on the effective date of the revised NPP, post the new notice at each physical site and on the website, and provide it to patients at their next visit. You do not have to individually mail the revised NPP to every prior patient unless youve agreed to do so.

Health plans: under § 164.520(c)(1)(iv), within 60 days of a material change, provide the revised NPP to plan members. Options for delivery: mail, secure message, posting on the members online account.

First-time question? See if your practice actually needs an NPP: Does my practice need a Notice of Privacy Practices? →