N NPP Generator

HIPAA Notice of Privacy Practices for Therapists

By NPP Generator Editorial Team  ·  Last reviewed Apr 28, 2026

Solo therapists, LCSWs, psychologists, and licensed counselors are HIPAA covered entities if they transmit health information electronically (most do, through billing or insurance claims). That means you need a Notice of Privacy Practices that complies with 45 CFR § 164.520 — posted on your website, provided at intake, and posted at your physical practice location.

Quick facts for therapists

Are you a HIPAA covered entity?

You are a covered entity if you electronically transmit any of these standard transactions: health care claims, eligibility verification, referral authorizations, claim status requests, enrollment, or payment/remittance advice. If your practice accepts insurance — even a single payer — you almost certainly transmit one of these electronically and are a covered entity.

Cash-only practices that never touch electronic claims may not be covered entities. But if you use an EHR, telehealth platform, or any third party that submits claims on your behalf, you are still covered.

Psychotherapy notes: the special case

HIPAA gives psychotherapy notes extra protection. Defined at § 164.501, psychotherapy notes are process notes kept separate from the regular medical record. Most uses and disclosures of psychotherapy notes require a separate written authorization from the patient, over and above the general NPP. The generator captures this and includes appropriate language.

What if you treat SUD clients?

If your practice is a 42 CFR Part 2 program (federally-assisted program that holds itself out as providing SUD diagnosis, treatment, or referral), you are subject to Part 2 in addition to HIPAA. The 2024 Part 2 Final Rule permits a single combined HIPAA/Part 2 notice. If you provide general therapy services with occasional SUD clients (without specializing in SUD care) you are generally not a Part 2 program.

Distribution for solo practices

More NPP guides by specialty

Addiction Treatment Centers Chiropractors Dental Practices Fqhc Home Health Hospice Mental Health Nurse Practitioners Occupational Therapy Optometry Pharmacy Physical Therapy Small Medical Practices Speech Language Pathology Telehealth Urgent Care

Generate a compliant NPP in 5 minutes

HHS Feb 2026 model · Part 2 SUD language · Section 1557 taglines · whether you're updating or starting fresh.

Update my existing NPP → Generate a new NPP →

No subscription · PDF + Word · Free watermarked preview · See sample →

More guides: Does my practice need an NPP? · NPP for therapists — complete guide · Part 2 SUD language · NPP for mental health

Related: Specialty NPP guides

Addiction treatment Chiropractors Dental FQHC Home health Hospice Mental health Nurse practitioners

Frequently Asked Questions

Do therapists need a Notice of Privacy Practices?
Yes — therapists, LCSWs, psychologists, and counselors who transmit health information electronically (most do via insurance billing) are HIPAA covered entities under 45 CFR § 160.103 and must distribute an NPP. Solo practice doesn't exempt you. Provide the NPP at the first appointment, post it in your office, and on any patient-facing website.
Does HIPAA's psychotherapy notes protection change my NPP?
Yes — your NPP must explicitly address psychotherapy notes if you maintain them. Under 45 CFR § 164.508(a)(2), most uses or disclosures of psychotherapy notes require separate written authorization beyond the standard NPP, even for treatment, payment, or operations. Disclose this distinction clearly so patients understand the heightened protection.
How do solo therapists distribute their NPP to clients?
Provide the NPP at the first appointment, obtain a written acknowledgment of receipt (or document your good-faith effort), post it visibly in your waiting area, and post it on your practice website. Re-distribute the NPP when materially changed — and post the new version within 60 days of the change.
Do I need state-specific language if I see clients in multiple states?
Yes — California (CMIA), New York, Massachusetts, and Washington (My Health My Data Act) impose stricter mental-health privacy requirements than federal HIPAA. Your NPP must reflect the strictest applicable rules for each client's location. Telehealth therapists who see out-of-state clients should add jurisdiction-aware NPP language.