Do nurse practitioners need a HIPAA Notice of Privacy Practices?

Yes, if you operate an independent NP practice that submits electronic claims. NPs employed exclusively by a hospital or physician group are covered by the employer's NPP. Independent NP practices are their own covered entities and must maintain a separate NPP.

Can I use the same NPP if I practice in multiple states?

You can use one NPP for your practice entity, but you should review state-specific privacy laws for each state where you see patients. Some states (CA, NY, MA) impose stricter requirements that may require supplemental language beyond the federal HIPAA baseline.

Does my telehealth NP practice need an NPP?

Yes. Telehealth practices are covered entities if they bill insurance electronically. The NPP must be provided electronically at first service (via your patient portal or email) and posted on your website. See our guide on NPP for telehealth practices.

What changes did HHS make to the NPP model in 2026?

The HHS February 2026 model updated and reorganized required NPP elements, integrated 42 CFR Part 2 SUD disclosures for applicable practices, and added new patient rights language. The previous 2013 model is out of compliance as of February 16, 2026.

HIPAA Notice of Privacy Practices for Nurse Practitioners

Nurse practitioners operating independent practices are HIPAA covered entities. Whether you run a solo NP clinic, a group APRN practice, or a telehealth-only NP service, you need a compliant Notice of Privacy Practices aligned to the HHS February 2026 revised model.

Quick facts for NP practices

Independent NP practices that bill insurance are their own HIPAA covered entities
NPs employed full-time by a hospital or group are covered by the employer's NPP
NPs who practice in multiple roles (employed + independent) need an NPP for the independent practice
Telehealth NP practices need an NPP — provide it electronically at first service
Mental health NPs must include psychotherapy-notes disclosure language if applicable

Is your NP practice a covered entity?

Your independent NP practice is a HIPAA covered entity if you transmit health information electronically in standard transactions. This includes submitting electronic claims directly or through a billing service, verifying insurance eligibility electronically, or using an EHR that transmits PHI. If you accept any insurance — Medicare, Medicaid, or commercial — you almost certainly qualify.

NPs in purely cash-pay direct primary care (DPC) models who never submit electronic claims may be exempt. But even DPC practices often use patient portals or EHRs that transmit PHI, which can trigger covered entity status. When in doubt, having a compliant NPP costs very little and protects you from enforcement risk.

NP-specific NPP considerations

Psychiatric and mental health NPs. If you prescribe psychotropic medications and maintain behavioral health records, consider whether your documentation includes psychotherapy notes (as defined by HIPAA § 164.501) — these require separate authorization language in your NPP.
NPs who treat SUD. If your practice is a Part 2 program (federally-assisted SUD treatment), you need combined HIPAA + 42 CFR Part 2 NPP language. See Part 2 SUD language.
Telehealth NP practices. Electronic distribution of the NPP is acceptable — via patient portal or email — but patients must receive it before or at first service. See NPP for telehealth.
State-specific requirements. Some states impose additional privacy requirements for certain categories of health information. California, New York, and Massachusetts have stricter rules than the federal baseline.

Distribution checklist

Provide to each new patient at first service (in-person or electronically for telehealth)
Request written acknowledgment; document good-faith attempts if patients decline
Post on your public website
Display at your office or clinic location
Update and redistribute when material changes occur

Frequently Asked Questions

Do nurse practitioners need a HIPAA NPP?▼

Yes, if you operate an independent NP practice that submits electronic claims or uses electronic health transactions. NPs who are employees of a larger organization are covered by the employer's NPP.

I'm starting a new NP practice — when do I need the NPP?▼

From day one. You must provide the NPP to your first patient at their first service date. You also need it posted on your website before you open. NPP Generator lets you create one in under 5 minutes before your first appointment.

Can I download a free NPP template from HHS?▼

HHS provides a model NPP, but it contains blanks for practice-specific information and does not include specialty-specific language. NPP Generator fills in the required details and outputs a practice-ready PDF and Word document.

Does my DPC practice need an NPP?▼

Direct primary care practices that accept no insurance and transmit no electronic health information may not be covered entities. However, most DPC practices use EHRs or patient portals that transmit PHI — when in doubt, produce a compliant NPP. See does my practice need an NPP?

Generate your NP practice NPP in under 5 minutes.

HHS February 2026 model, PDF + editable Word. Ready to post on your website and provide at intake. $49 one-time — no subscription.

Start your NPP — $49

Free watermarked preview available. See sample →

More guides: Does my practice need an NPP? · NPP for telehealth · NPP for small medical practices · NPP requirements in 2026