Where to post your NPP in the office (and how to keep it current)

By NPP Generator Editorial Team  ·  Published Oct 4, 2026  ·  Last reviewed Oct 4, 2026  ·  5 min read

Most NPP guidance is about the content of the notice and the website posting rule. The paper copy on the office wall gets less attention. It is a separate requirement, and it is the one an OCR investigator or a patient can check by walking in the door.

What the rule requires

A covered health care provider with a direct treatment relationship, and a physical service delivery site, has to do two things at that site (45 CFR 164.520(c)(2)(iii)).

1. Have the notice available for patients to request and take with them.
2. Post the notice "in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered health care provider to be able to read the notice."

When the notice is revised, the provider has to make the new version available on or after its effective date and promptly replace the posted copy (164.520(c)(2)(iv)). The website posting rule in 164.520(c)(3)(i) is separate. Posting online does not satisfy the in-office requirement, and posting in the office does not satisfy the website requirement. See How to post your NPP on your website for that part.

Where to post it

The test is whether a patient can reasonably read it. The rule does not name a wall, but these locations meet the test in most offices.

1. The waiting room, at eye level, near the seating. This is the default location.
2. Beside the check-in window or front desk, if the waiting room is very small or patients go straight to the counter.
3. Each entrance patients use, if the office has more than one.
4. Each location, for multi-location practices. Every service delivery site needs its own posted copy. See NPP for multi-location practices.

Locations that do not meet the test:

1. Inside a binder at the front desk. That satisfies the "available on request" half only.
2. A staff hallway, break room, or back office.
3. Behind the reception glass, unless patients can read it from where they stand.

Format

1. Post the full notice, not a summary. A short summary can sit alongside it, but it does not replace it.
2. Use a readable font size. If the full notice runs several pages, a frame or acrylic holder that shows every page, or a wall-mounted holder with a posted first page and copies to take, both work.
3. Use the same version and effective date as your website copy and your handout copies.
4. Post the language versions your patients need. If you provide translated notices, post them next to the English copy.

Keeping the posted copy current

Posting once is easy. Most problems show up later.

1. The wall copy is out of date. Practices update the website and the handout and forget the frame in the waiting room. Practices that updated for the February 2026 changes should confirm the posted copy matches.
2. The wall copy is gone. Posted paper gets removed during renovations, repainting, furniture moves, and routine cleaning.
3. The location changed. A practice moves its front desk or opens a second entrance and the notice stays where it was.

A short monthly check prevents all three. Have one person confirm the posted copy is present, readable, and matches the current effective date.

Tell everyone who works in the space

Staff are not the only people who touch the waiting room. Contractors, movers, and the evening cleaning crew all work in it, usually after hours. A posted notice in a cheap frame can get taken down to wipe a wall and never go back up.

1. Mount the notice in a fixed frame or holder rather than taping it to the wall.
2. Tell your building manager and any contractor doing work in the waiting room that the posted notices stay up.
3. Include posted notices in your cleaning instructions. A commercial cleaning company that works in dental and medical offices should already treat posted notices and patient paperwork as things to clean around, not move. Put it in writing anyway.

Routine cleaning crews do not need a BAA, because any contact with patient information is incidental under HHS guidance. See Does your cleaning company need a BAA? for the details.

Posting checklist

1. The notice is posted where patients wait or check in, at eye level.
2. Every patient entrance and every location has a posted copy.
3. Copies are available to take at the front desk.
4. The posted version matches the website and the handout, with the same effective date.
5. Translated versions are posted next to the English copy where you provide them.
6. The notice is in a fixed frame or holder.
7. Someone checks the posted copy monthly.
8. Contractors and the cleaning crew know posted notices stay up.

Frequently asked questions

Sources

1. 45 CFR 164.520, Notice of privacy practices for protected health information. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520
2. HHS FAQ 243, business associate contracts and incidental contact with PHI. https://www.hhs.gov/hipaa/for-professionals/faq/243/is-a-business-associate-contract-required-for-inadvertent-contact-with-phi/index.html