Complete Guide: HIPAA NPP for Therapists

Everything a licensed therapist in solo or group practice needs to know about the Notice of Privacy Practices requirement — content, distribution, and state-law considerations.

By NPP Generator Research Team  ·  Published Mar 8, 2026  ·  Last reviewed Apr 23, 2026

Are you a HIPAA covered entity?

Most therapists in private practice are HIPAA covered entities. The trigger is whether you transmit any of the nine standard transactions electronically — most commonly, insurance claims. If you accept insurance, you are almost certainly a covered entity, even if you outsource billing to a service. A pure cash-pay practice that never sends claims electronically may not be covered.

Psychotherapy notes vs. the medical record

HIPAA distinguishes two categories of records in therapy practice:

• The medical record (PHI): diagnosis, treatment plan, start and stop times, modalities, medications, prognosis, summary of progress. Treated like other PHI for NPP purposes.
• Psychotherapy notes: process notes kept separate from the medical record, documenting the therapists impressions, analysis, and content of sessions. Most uses and disclosures of psychotherapy notes require separate written patient authorization — including disclosure to other treating providers.

What your NPP should say about psychotherapy notes

The NPP should explicitly state: (1) psychotherapy notes are maintained separately from the medical record; (2) most uses and disclosures of psychotherapy notes require separate written authorization; (3) the authorization may be revoked at any time; (4) certain uses (quality assessment, defense in legal proceedings, mandatory reporting) do not require authorization.

Distribution in solo therapy practice

Direct-treatment providers (including all therapists) must: (1) provide the NPP at first service delivery; (2) post it at the physical service site; (3) post it on the practice website; (4) make a good-faith effort to obtain written acknowledgment of receipt.

If you also handle SUD clients

A general therapy practice that sees occasional clients with SUD is usually not a Part 2 program. A practice that advertises or specializes in SUD treatment — "addiction therapy," "substance use counseling" — likely is. Part 2 programs need integrated Part 2 language in the NPP, per the 2024 Final Rule.

State-law considerations

Several states impose stricter mental-health privacy rules: California (LPS Act, CMIA), New York (Mental Hygiene Law § 33.13), Massachusetts (chapter 123 § 36), others. These may require disclosures in the NPP beyond what HIPAA alone requires. Our generator uses a generic state-law disclaimer; for state-specific language, engage healthcare counsel.

First-time question? See if your practice actually needs an NPP: Does my practice need a Notice of Privacy Practices? →