NPP for Practices with Multiple Locations
NPP Generator Research Team · April 25, 2026 · 5 min read
Key Takeaways
- ✓ One NPP covers all locations if they operate under the same legal entity
- ✓ Separately incorporated locations are separate covered entities — each needs its own NPP
- ✓ Under common ownership, separately incorporated entities can designate as an "affiliated covered entity" to share one NPP
- ✓ The NPP should identify the covered entity clearly — listing all sites is good practice, not required
- ✓ Distribution requirements apply at every location — each site must post and provide the NPP
Multi-site practices face a straightforward question: can we use one NPP across all our locations? The answer depends on the legal structure — not the number of addresses on the door.
The legal entity rule
HIPAA's NPP obligation attaches to covered entities — legal entities, not physical locations. If your practice operates all locations under a single legal entity (single LLC, PC, or corporation with one EIN), one NPP covers every location. If your locations are separately incorporated, each is its own covered entity with its own NPP requirement.
| Structure | Example | NPP needed |
|---|---|---|
| Single legal entity, multiple sites | Acme Medical LLC operates 4 clinics | One NPP for all 4 clinics |
| Separate LLCs under common ownership | Clinic A LLC + Clinic B LLC, same owner | One NPP per entity — unless affiliated covered entity designation is made |
| Affiliated covered entity (ACE) | Health system with 3 separate subsidiary entities that designate as an ACE | One NPP if ACE designation is documented |
| Franchise model | Each franchisee is separately incorporated | One NPP per franchisee entity |
The affiliated covered entity option
Under 45 CFR § 164.105, legally separate covered entities that are under common ownership or control may designate themselves as a single "affiliated covered entity" (ACE) for HIPAA compliance. An ACE can:
- Use a single NPP for all member entities
- Share PHI among members for treatment, payment, and healthcare operations without patient authorization
- Designate a single Privacy Officer for the combined entity
The ACE designation must be documented — it is not automatic simply because entities are under common ownership. Work with your HIPAA compliance attorney to document the designation and ensure the shared NPP reflects the combined entity's operations correctly.
What to put in the NPP for a multi-site practice
For a single legal entity with multiple sites, the NPP should:
- Identify the covered entity clearly. Use the full legal name of the entity, not just a trade name. Patients should be able to match the NPP to the practice they visited.
- Describe the scope. Consider a statement like "This NPP applies to [Entity Name] and all of its service locations." This avoids having to enumerate every address and still makes clear the NPP covers all sites.
- Name the Privacy Officer. A single Privacy Officer (or contact info for a privacy department) is sufficient for a multi-site entity.
- Effective date. The same effective date applies to all locations under the single entity.
Distribution at each location
Even with one NPP document, distribution requirements apply at every location:
- Each location must post the NPP in a visible area (waiting room or service delivery area)
- Each location must provide the NPP to patients at first service
- If a patient's first service at Location B was different from Location A, the NPP obligation applies at each site's first service date
- If your entity has a website (or each location has a separate website), the NPP must be posted on any website that contains health services information
Quick answer
If all your locations operate under the same legal entity, one NPP covers them all — state that it applies to all locations of [Entity Name]. If locations are separately incorporated, each needs its own NPP or you need to document an affiliated covered entity designation.
Generate one compliant NPP for your multi-site practice.
HHS February 2026 model, PDF + editable Word. Deploy at every location from one document. $49 one-time, no subscription.
Generate your NPP — $49Free watermarked preview available. See sample →
Frequently Asked Questions
Can one NPP cover multiple locations?▼
Yes, if all locations are part of the same legal entity. The NPP belongs to the covered entity, not to physical addresses. One entity, one NPP — regardless of how many locations.
Do I need a separate NPP for each state I operate in?▼
Generally no — the entity's NPP applies wherever it operates. However, if your entity practices in states with stricter privacy laws (CA, NY, MA), the NPP should acknowledge that more protective state law applies at those locations. See our state-specific guides.
Does each location need to post the NPP separately?▼
Yes. Posting requirements apply at each service delivery location — each site must display the NPP in a visible area. Providing one master NPP document to all sites to print and post is the simplest approach.
What is an affiliated covered entity (ACE)?▼
An affiliated covered entity is a group of legally separate covered entities under common ownership that have documented a designation to be treated as a single covered entity under HIPAA — allowing them to share one NPP and share PHI for treatment, payment, and operations. The designation must be formally documented under 45 CFR § 164.105.