HIPAA Notice of Privacy Practices for Home Health Agencies

By NPP Generator Editorial Team  ·  Last reviewed Apr 28, 2026

Home health agencies are HIPAA covered entities. Whether you provide skilled nursing, physical therapy, occupational therapy, or personal care services — and bill Medicare, Medicaid, or private insurance electronically — you need a compliant Notice of Privacy Practices aligned to the HHS February 2026 model.

Home health and HIPAA covered entity status

Home health agencies are covered entities under HIPAA because they transmit health information electronically as part of claims submission for Medicare and Medicaid services. The Medicare Conditions of Participation (CoPs) for home health agencies also mandate patient rights documentation, which runs parallel to the HIPAA NPP requirement.

Agencies that provide only non-medical personal care services (aide services billed through Medicaid waiver programs without health care claim transmission) may occupy a different compliance position — but most home health agencies that provide any skilled nursing or therapy services will qualify as covered entities.

Home health–specific NPP distribution challenges

Home health agencies face a unique distribution challenge: unlike a clinic, there is no physical waiting room where the NPP can be prominently posted. Best practices for home health NPP distribution include:

• Intake packet delivery. Include the NPP in every new patient intake packet, delivered at the initial assessment visit
• Personal representative delivery. For patients who cannot sign, provide the NPP to their legal representative and obtain acknowledgment
• Website posting. Post the full NPP on your agency website — required for agencies with a web presence
• Electronic delivery option. For patients who prefer electronic communication, NPP can be emailed with acknowledgment requested by return email
• Documentation of good-faith attempts. Document every attempt to get acknowledgment, including refusals

What your NPP must include

• Uses and disclosures — treatment coordination with physicians, payment to Medicare/Medicaid/insurers, and operations
• Patient rights — access to records, requests for amendment, accounting of disclosures, right to restrict disclosures to health plans for services paid out of pocket, and right to receive confidential communications
• Contact information for your Privacy Officer
• Complaint procedure including HHS OCR contact information
• Effective and supersede dates

Frequently Asked Questions