N NPP Generator

HIPAA Notice of Privacy Practices for Mental Health Providers

By NPP Generator Editorial Team  ·  Last reviewed Apr 28, 2026

Mental health providers — therapists, psychiatrists, counselors, and behavioral-health organizations — need a HIPAA Notice of Privacy Practices that accounts for the sensitivity of mental-health records. Generate one now.

Quick facts for mental-health entities

Why mental-health entities need a tailored NPP

Mental health is one of the most privacy-sensitive categories in healthcare. HIPAA recognizes this in two ways: (1) psychotherapy notes get extra protection requiring separate written authorization for most uses; (2) entities subject to 42 CFR Part 2 (federally-assisted SUD programs) get a whole additional privacy framework on top of HIPAA. Your NPP needs to reflect whichever of these applies to your practice.

Psychotherapy notes

Under § 164.501, psychotherapy notes are process notes kept separate from the regular medical record — they document the therapist's impressions and analysis during a session. Most uses and disclosures of psychotherapy notes require separate written authorization, including disclosures for treatment coordination with other providers. Your NPP should describe this distinction and explain that patients can request their regular record but not necessarily the psychotherapy notes.

Are you a Part 2 program?

42 CFR Part 2 applies to "federally-assisted programs" that "hold themselves out as providing, and provide, SUD diagnosis, treatment, or referral for treatment." If your organization advertises SUD services, is licensed as an SUD treatment facility, or receives federal funding tied to SUD care (SAMHSA grants, Medicare/Medicaid SUD reimbursement), you are likely a Part 2 program. General mental-health practices that occasionally address SUD without specializing are typically not.

Part 2 additions in the combined notice

If you are a Part 2 program (or a combined HIPAA + Part 2 entity), the 2024 Part 2 Final Rule permits you to use a single integrated notice. Required Part 2 content in the NPP: written-consent requirement for most SUD-record disclosures, redisclosure prohibition by recipients, subpoena protections, and breach notification for Part 2 records.

State-law overlays

Several states impose stricter mental-health privacy rules: California's Lanterman-Petris-Short Act and the Confidentiality of Medical Information Act (CMIA); New York's Mental Hygiene Law § 33.13; Massachusetts General Laws chapter 123 § 36. These may require additional disclosures in your NPP beyond federal HIPAA. Our generator includes a generic state-law disclaimer; for state-specific language, consult healthcare counsel.

More NPP guides by specialty

Addiction Treatment Centers Chiropractors Dental Practices Fqhc Home Health Hospice Nurse Practitioners Occupational Therapy Optometry Pharmacy Physical Therapy Small Medical Practices Speech Language Pathology Telehealth Therapists Urgent Care

Generate a compliant NPP in 5 minutes

HHS Feb 2026 model · Part 2 SUD language · Section 1557 taglines · whether you're updating or starting fresh.

Update my existing NPP → Generate a new NPP →

No subscription · PDF + Word · Free watermarked preview · See sample →

Not sure if your practice needs an NPP? Find out in 30 seconds →

Related: Specialty NPP guides

Addiction treatment Chiropractors Dental FQHC Home health Hospice Nurse practitioners Occupational therapy

Frequently Asked Questions

Do mental-health practices need a Notice of Privacy Practices?
Yes — mental-health providers (counselors, psychologists, psychiatrists, behavioral-health agencies) who electronically transmit health information are HIPAA covered entities under 45 CFR § 160.103. The Privacy Rule (§ 164.520) requires every covered entity to maintain and distribute a Notice of Privacy Practices.
How does 42 CFR Part 2 affect a mental-health NPP?
If your practice or service line is a federally-assisted SUD treatment program, 42 CFR Part 2 applies in addition to HIPAA. Your NPP must reference the heightened consent requirements for SUD records. The Feb 2026 Part 2 Final Rule aligned much of Part 2 with HIPAA but kept distinct rules around re-disclosure and patient consent.
What's different about a mental-health NPP versus a primary-care NPP?
Mental-health NPPs address psychotherapy notes (most uses require separate authorization under § 164.508(a)(2)), state-law overlays for sensitive mental-health records, Part 2 language if SUD services are offered, and any distinct rules for minors' mental-health information that vary by state.
How often should a mental-health practice update its NPP?
Re-distribute the NPP at material changes: new uses/disclosures, structural changes, new state-law requirements, or major federal updates (like the HHS February 2026 model NPP). At minimum, review the NPP annually. Patients receiving services on or after the change date must be given the updated version.