HIPAA Notice of Privacy Practices for Massachusetts Practices

Massachusetts imposes strict health information privacy and data security requirements that supplement federal HIPAA. Practices in Massachusetts must comply with both — and wherever Massachusetts law is more protective, it governs. This guide covers the key state-law considerations for Massachusetts providers producing their HIPAA NPP.

Massachusetts 201 CMR 17.00 — data security

Massachusetts 201 CMR 17.00, the "Standards for the Protection of Personal Information of Residents of the Commonwealth," is one of the strictest state data security regulations in the United States. It requires any business — including health care providers — that handles personal information of Massachusetts residents to maintain a comprehensive Written Information Security Program (WISP).

Key requirements of 201 CMR 17.00 that affect health care providers:

• Documented Written Information Security Program (WISP) — separate from the NPP, but both are required
• Specific technical safeguards: encryption of stored and transmitted personal information
• Access controls, monitoring, and incident response procedures
• Vendor oversight for third parties that handle personal information

The WISP is an internal document — not patient-facing. It does not replace or substitute for the HIPAA NPP. Massachusetts providers need both.

Massachusetts mental health record confidentiality

Massachusetts General Laws Chapter 123 governs the confidentiality of records at facilities licensed by the Department of Mental Health. It imposes restrictions on disclosure of mental health treatment records that go beyond federal HIPAA's psychotherapy-notes protections:

• Broader definition. Massachusetts MGL c. 123 applies to a broader category of mental health records than HIPAA's psychotherapy-notes definition. Records of "treatment" at DMH-licensed or -funded facilities are covered.
• Disclosure restrictions. Many disclosures require patient consent even for treatment-related purposes — stricter than HIPAA's TPO exceptions.
• Court access restrictions. Massachusetts courts have limited access to mental health records in civil proceedings beyond what federal law requires.

Mental health practices licensed by the Massachusetts DMH should consult legal counsel about MGL c. 123 compliance and how it affects their NPP disclosures. See states with stricter NPP requirements.

What Massachusetts practices need in their NPP

• All federal HIPAA NPP requirements (HHS February 2026 model)
• A statement that Massachusetts law may provide additional privacy protections beyond federal HIPAA
• For mental health providers licensed by DMH: reference to Massachusetts confidentiality protections
• Privacy Officer contact information for state-law questions
• Separate internal WISP (not part of NPP) to comply with 201 CMR 17.00

Frequently Asked Questions