HIPAA Notice of Privacy Practices for Pharmacies
Pharmacies are one of the most clearly defined HIPAA covered entities — electronic prescription processing is the core of their operations. Whether you run an independent community pharmacy, a specialty pharmacy, or a compounding pharmacy, you need a Notice of Privacy Practices aligned to the HHS February 2026 model.
Quick facts for pharmacies
- All pharmacies that process prescription claims electronically are HIPAA covered entities
- The NPP must be provided to new patients and posted visibly at the pharmacy counter
- Your NPP must be updated to the HHS February 2026 model — the 2013 version is non-compliant
- For independent franchises: verify whether your entity is separate from the chain before using the parent's NPP
- Pharmacies that dispense SUD medications under a Part 2 program need integrated Part 2 NPP language
Why pharmacies are always covered entities
Unlike some health care providers for whom HIPAA coverage is fact-specific, pharmacies that process prescription claims electronically are HIPAA covered entities by definition. Electronic claims submission to pharmacy benefit managers (PBMs) — Express Scripts, CVS Caremark, OptumRx, and others — constitutes transmission of health information in standard electronic form under HIPAA.
This means nearly every pharmacy in the United States is a covered entity, including independent community pharmacies, specialty pharmacies, compounding pharmacies, and mail-order pharmacy operations. The NPP obligation applies to all of them.
Pharmacy-specific NPP considerations
- SUD medications. Pharmacies that dispense methadone for opioid treatment programs (OTPs) or buprenorphine under a Part 2-subject program may need to include 42 CFR Part 2 language in their NPP. See Part 2 SUD language in your NPP.
- Specialty pharmacies. Specialty pharmacies maintaining complex patient profiles (oncology, HIV, rare disease) hold sensitive PHI categories. Standard HIPAA NPP requirements apply; check state law for any additional requirements.
- Dispensing authorizations. The NPP should address disclosures to prescribers for prescription verification and to other health care providers involved in patient care.
- Mail-order operations. Mail-order pharmacies must make the NPP available on their website and provide it electronically to new patients.
Pharmacy NPP distribution requirements
- Provide to each new patient at the time of first prescription service
- Post in a clear and prominent location at the pharmacy counter
- Post on your website (required for pharmacies with a web presence)
- Provide a paper copy to any patient who requests one
- Update and redistribute when material changes occur
Frequently Asked Questions
Do pharmacies need a HIPAA NPP?▼
Yes. All pharmacies that process electronic prescription claims are HIPAA covered entities. The NPP is required by 45 CFR § 164.520 and must be provided to patients at first service and posted at the pharmacy.
Does my independent pharmacy need its own NPP if I'm a franchise?▼
It depends on your legal structure. If your pharmacy is a separate legal entity from the franchisor, it is its own covered entity and needs its own NPP. If it is wholly owned and operated by the parent company, the parent's NPP may apply. Confirm with your attorney or franchisor.
Does a compounding pharmacy need an NPP?▼
Yes, if it processes electronic prescription transactions or receives prescriptions electronically. Most compounding pharmacies are HIPAA covered entities and must provide patients with a Notice of Privacy Practices.
What changed in the 2026 NPP model for pharmacies?▼
The HHS February 2026 model updated required disclosures and integrated 42 CFR Part 2 SUD language for applicable entities. It also reorganized patient rights sections. The 2013 model is no longer compliant. See HHS model NPP 2026 walkthrough.
Generate your pharmacy NPP in under 5 minutes.
HHS February 2026 model, PDF + editable Word. Post at your counter and on your website. $49 one-time — no subscription.
Start your NPP — $49Free watermarked preview available. See sample →