HIPAA Notice of Privacy Practices for Mental Health Providers

Mental health providers — therapists, psychiatrists, counselors, and behavioral-health organizations — need a HIPAA Notice of Privacy Practices that accounts for the sensitivity of mental-health records. Generate one now.

Why mental-health entities need a tailored NPP

Mental health is one of the most privacy-sensitive categories in healthcare. HIPAA recognizes this in two ways: (1) psychotherapy notes get extra protection requiring separate written authorization for most uses; (2) entities subject to 42 CFR Part 2 (federally-assisted SUD programs) get a whole additional privacy framework on top of HIPAA. Your NPP needs to reflect whichever of these applies to your practice.

Psychotherapy notes

Under § 164.501, psychotherapy notes are process notes kept separate from the regular medical record — they document the therapist's impressions and analysis during a session. Most uses and disclosures of psychotherapy notes require separate written authorization, including disclosures for treatment coordination with other providers. Your NPP should describe this distinction and explain that patients can request their regular record but not necessarily the psychotherapy notes.

Are you a Part 2 program?

42 CFR Part 2 applies to "federally-assisted programs" that "hold themselves out as providing, and provide, SUD diagnosis, treatment, or referral for treatment." If your organization advertises SUD services, is licensed as an SUD treatment facility, or receives federal funding tied to SUD care (SAMHSA grants, Medicare/Medicaid SUD reimbursement), you are likely a Part 2 program. General mental-health practices that occasionally address SUD without specializing are typically not.

Part 2 additions in the combined notice

If you are a Part 2 program (or a combined HIPAA + Part 2 entity), the 2024 Part 2 Final Rule permits you to use a single integrated notice. Required Part 2 content in the NPP: written-consent requirement for most SUD-record disclosures, redisclosure prohibition by recipients, subpoena protections, and breach notification for Part 2 records.

State-law overlays

Several states impose stricter mental-health privacy rules: California's Lanterman-Petris-Short Act and the Confidentiality of Medical Information Act (CMIA); New York's Mental Hygiene Law § 33.13; Massachusetts General Laws chapter 123 § 36. These may require additional disclosures in your NPP beyond federal HIPAA. Our generator includes a generic state-law disclaimer; for state-specific language, consult healthcare counsel.

Not sure if your practice needs an NPP? Find out in 30 seconds →