3.1 Notice of Privacy Practices (NPP): Content Requirements, Distribution, and Acknowledgment

Notice of Privacy Practices (NPP): Content Requirements, Distribution, and Acknowledgment

AHIMA CHPS Blueprint Focus: The Notice of Privacy Practices (NPP) is the fundamental transparency mechanism under the HIPAA Privacy Rule (45 CFR § 164.520). The CHPS exam heavily tests exact statutory phrasing, required content disclosures (including HITECH Omnibus Rule updates), precise distribution triggers across direct providers versus health plans, good faith acknowledgment workflows, emergency care exceptions, and the strict non-conditioning rule.

---

1. Statutory Architecture and Mandatory Header

The Notice of Privacy Practices is governed by 45 CFR § 164.520. Under this standard, every covered entity—except correctional institutions that are covered entities and inmate populations—must produce and distribute a notice that details how protected health information (PHI) may be used and disclosed, the individual's legal rights regarding their health data, and the covered entity's statutory privacy obligations.

The Mandatory Verbatim Header

To satisfy 45 CFR § 164.520(b)(1)(i), the notice must contain the following exact, capitalized, verbatim statement prominently displayed as a header or immediately following the title:

"THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

Any alteration, truncation, paraphrasing, or omission of this verbatim phrase is a facial regulatory violation. On the CHPS exam, distractors often substitute phrases such as "This notice explains your privacy rights..." or omit "PLEASE REVIEW IT CAREFULLY." Candidates must instantly recognize the exact regulatory wording.

---

2. Mandatory Content Requirements

The Privacy Rule specifies non-negotiable content sections that must appear in every NPP. These requirements were expanded significantly under the 2013 HITECH Omnibus Final Rule.

A. Description of Uses and Disclosures for TPO

The notice must describe the types of uses and disclosures that the covered entity is permitted to make for Treatment, Payment, and Health Care Operations (TPO) under 45 CFR § 164.506. The description must include at least one concrete example for each category:

• Treatment: E.g., sharing medical history with a referring cardiologist or inpatient physical therapist to coordinate rehabilitation.
• Payment: E.g., submitting diagnostic codes and clinical documentation to an insurer or clearinghouse to adjudicate an insurance claim.
• Health Care Operations: E.g., conducting internal clinical quality assessments, peer review, medical student training, or compliance audits.

B. Uses and Disclosures Requiring Written Authorization

The NPP must inform individuals of categories of disclosures that strictly require valid, written authorization under 45 CFR § 164.508, including:

1. Psychotherapy Notes: Explicit statement that most uses and disclosures of psychotherapy notes (maintained separately by a mental health professional) require signed patient authorization.
2. Marketing: Statement that uses and disclosures of PHI for marketing purposes, including subsidized treatment communications where third-party remuneration is involved, require written authorization.
3. Sale of PHI: Explicit disclosure that any disclosure of PHI that constitutes a sale (transfer of PHI for direct or indirect financial or other valuable remuneration) requires specific patient authorization.
4. Other Uses: Clear notification that any uses and disclosures not described in the notice will be made only with the individual's written authorization, which may be revoked in writing at any time.

C. Specific Entity Disclosures and Opt-Outs

If the covered entity intends to engage in any of the following activities, specific disclosures and opt-out mechanisms must be detailed in the NPP:

• Fundraising Communications (45 CFR § 164.514(f)): If the entity engages in fundraising, the NPP must state that the individual has the absolute right to opt out of receiving fundraising communications.
• Facility Directory (45 CFR § 164.510(a)): Inpatient facilities must explain their practice of including patient name, location in facility, general condition, and religious affiliation in hospital directories, alongside the patient's right to restrict or prohibit inclusion.
• Underwriting (Health Plans): Health plans (other than long-term care plans) must include an explicit statement prohibiting the use or disclosure of genetic information for underwriting purposes under the Genetic Information Nondiscrimination Act (GINA) and 45 CFR § 164.520(b)(1)(iii)(C).

D. Individual Rights Delineation

The notice must clearly describe the individual's statutory rights under 45 CFR §§ 164.522 through 164.528, including specific instructions on how to exercise each right:

• Right to Inspect and Copy: The right to inspect and obtain a copy of PHI in a Designated Record Set (45 CFR § 164.524).
• Right to Request Amendments: The right to request an amendment of inaccurate or incomplete PHI in a Designated Record Set (45 CFR § 164.526).
• Right to an Accounting of Disclosures: The right to receive a formal accounting of disclosures made outside TPO and authorizations (45 CFR § 164.528).
• Right to Request Restrictions: The right to request restrictions on uses and disclosures for TPO, and the mandatory right to restrict disclosures to a health plan for payment or operations when the service has been paid in full out of pocket (45 CFR § 164.522(a)).
• Right to Confidential Communications: The right to request communications of PHI by alternative means or at alternative locations (45 CFR § 164.522(b)).
• Right to a Paper Copy: The right to obtain a physical paper copy of the notice upon request, even if the individual previously agreed to receive it electronically.
• Right to Breach Notification: Under the HITECH Act Omnibus Rule, the NPP must include a statement that affected individuals have the right to be notified following a breach of their unsecured PHI (45 CFR § 164.520(b)(1)(v)(A)).

E. Covered Entity Statutory Duties

The NPP must state the covered entity's legal obligations:

• Legal Duty: A statement that the covered entity is required by federal law to maintain the privacy of PHI, provide individuals with notice of its legal duties and privacy practices, and abide by the terms of the notice currently in effect.
• Reservation of Right to Change Terms: If the entity wishes to apply revisions to PHI created or received prior to the revision, the NPP must explicitly state that it reserves the right to change the terms of its notice and make the new notice provisions effective for all PHI maintained.
• Revision Distribution: The notice must describe how the entity will communicate revised notices to individuals.
• Effective Date: The notice must contain an explicit effective date (e.g., "Effective Date: September 15, 2026"), which cannot be earlier than the date the notice is published or printed.

F. Complaints and Contact Information

The NPP must state that individuals may file a complaint with both the covered entity and the Secretary of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR):

• Must provide the title/office and contact telephone number of the designated Privacy Official or compliance contact person.
• Must describe the procedure for filing a complaint with the entity and with the HHS OCR.
• Must state unequivocally that the covered entity will not retaliate against any individual for filing a complaint (45 CFR § 164.530(g)).

---

3. Distribution Requirements by Entity Type

Distribution mandates diverge sharply depending on whether the entity is a direct treatment provider, indirect provider, or health plan.

Direct Treatment Provider Protocols

For healthcare providers with a direct treatment relationship (e.g., outpatient clinics, ambulatory surgery centers, dentists, inpatient units):

1. First Service Delivery: Must provide the NPP no later than the date of first service delivery. If the first service is provided electronically (such as via telemedicine), the notice must be delivered electronically concurrent with the service.
2. Physical Facility Posting: Direct providers must post the NPP in a clear and prominent location where individuals seeking service are reasonably expected to read it (e.g., patient registration desks, waiting rooms).
3. Summary Notice Option: Providers may display a summarized version of the notice as a wall poster or brochure display, provided the full notice is immediately available upon request at the same location.

Health Plan Protocols

Health plans do not have direct physical patient encounters at registration desks. Therefore, their rules follow a periodic administrative schedule:

1. Enrollment: Provide the notice at the time of enrollment to the primary subscriber/policyholder.
2. Triennial Notice of Availability: Under 45 CFR § 164.520(c)(1)(ii), the health plan must, at least once every three years, notify named insureds of the availability of the notice and instructions on how to obtain it (e.g., via annual enrollment packets, policy renewals, or newsletters).
3. Material Revisions: If the health plan makes a material revision to its NPP, it must post the revised notice on its website by the effective date of the revision, and include the revised notice (or an explanation of material changes) in its next annual mailing to individuals then covered by the plan.

---

4. Good Faith Acknowledgment Standard & Emergency Exceptions

Under 45 CFR § 164.520(c)(2)(ii), a covered healthcare provider with a direct treatment relationship must make a good faith effort to obtain a written acknowledgment of receipt of the NPP.

                                [Patient Encounter: First Service Delivery]
                                                     |
                                                     v
                                      [Emergency Treatment Situation?]
                                         /                       \
                                       YES                        NO
                                       /                            \
                 [Treat Patient Immediately]             [Deliver Full NPP to Patient]
                             |                                       |
             [Seek Acknowledgment Once Stable]           [Request Written Acknowledgment]
                             |                                       |
                             +-------------------+-------------------+ 
                                                 |
                                                 v
                                 [Patient Signs Acknowledgment?]
                                         /              \
                                       YES               NO (Refusal / Incapacitation)
                                       /                   \
                   [File Signed Acknowledgment]      [Document Good Faith Effort & Reason]
                               |                                   |
                               +-----------------+-----------------+ 
                                                 |
                                                 v
                                [Retain Documentation for 6 Years]
                                [Proceed with Care Without Penalty]

The Emergency Care Exception

Under 45 CFR § 164.520(c)(2)(i)(B), if a direct provider renders emergency treatment:

• The provider is exempt from delivering the NPP prior to or at the time of initial care.
• The provider must deliver the NPP as soon as reasonably practicable after the emergency treatment situation has resolved.
• The provider is not required to attempt to obtain written acknowledgment during the emergency. Acknowledgment should be sought once the patient is stabilized.

Handling Refusals and Non-Signatures

Patients frequently refuse to sign the acknowledgment or are physically or cognitively unable to sign:

• Mandatory Documentation: If the individual refuses or fails to sign, the provider must document its good faith efforts and the precise reason why the acknowledgment was not obtained (e.g., "Patient presented with severe respiratory distress; unable to sign at registration. NPP provided; patient refused to sign acknowledgment stating they do not sign legal forms. Reason: Patient verbal refusal.").
• The Non-Conditioning Rule: A covered entity cannot condition treatment, payment, or enrollment on the patient signing the acknowledgment (45 CFR § 164.506 / § 164.520). Withholding medical examination or treatment because a patient refuses to sign the NPP acknowledgment is an egregious HIPAA Privacy Rule violation.

---

5. Electronic Delivery and Website Posting Mandates

Under 45 CFR § 164.520(c)(3), covered entities operating public-facing websites must satisfy specific digital distribution rules:

• Prominent Website Posting: If a covered entity maintains a website providing information about customer services or benefits, it must post its Notice of Privacy Practices prominently on the site and make it electronically available through the site.
• Electronic Notice Delivery: The entity may deliver the NPP by email if the individual has agreed to electronic notice and has not withdrawn that agreement.
• Right to Paper Copy: If an individual agrees to receive the notice electronically, the individual still retains the legal right to obtain a paper copy of the notice immediately upon request.
• Automatic Email Delivery: If the covered entity knows that an electronic transmission of the notice has failed (e.g., bounced email), a physical copy must be provided to the individual.

---

6. Mandatory NPP Revision for 42 CFR Part 2 (Compliance Deadline: February 16, 2026)

The most significant live NPP compliance event for a 2026 CHPS candidate is the conforming amendment to 45 CFR § 164.520 adopted alongside the 2024 Confidentiality of Substance Use Disorder Patient Records Final Rule.

Who Must Act

The obligation reaches any covered entity that creates, receives, maintains, or transmits records protected by 42 CFR Part 2 — not merely licensed addiction treatment programs. A general acute care hospital that receives Part 2 records from an affiliated opioid treatment program and files them in its enterprise EHR is squarely within scope.

Required Content Additions

Beyond all standing § 164.520 content, the revised notice must describe:

• The uses and disclosures of Part 2 records permitted or required without patient consent, and those that require written consent;
• A statement that Part 2 records disclosed with consent may not be re-disclosed except as permitted by 42 CFR Part 2, mirroring the § 2.32 notice;
• A statement that Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient absent written patient consent or a Part 2 Subpart E court order;
• The individual's right to file a complaint concerning a Part 2 violation, and the mechanism for doing so.

Permitted Consolidation

HHS has confirmed that an organization may combine its HIPAA Privacy Rule notice and its Part 2 notice into a single document, provided the combined notice satisfies every element of both 45 CFR § 164.520 and 42 CFR § 2.22. Maintaining two standalone notices is optional, not required.

Why This Deadline Survived

This § 164.520 amendment is notable because it is the only portion of the 2024 rulemaking package left standing after Purl v. U.S. Department of Health and Human Services vacated the companion Reproductive Health Care Privacy Rule nationwide on June 18, 2025. Candidates who studied the 2024 rules as a single bundle frequently get this backwards.

[!IMPORTANT] Distribution Follows Revision. Rewriting the notice is not compliance. A material revision triggers the full redistribution machinery of § 164.520(c): a direct treatment provider must post the revised notice in a clear and prominent location at the service delivery site and make copies available on request, and a health plan must notify covered individuals of the material revision within 60 days. An entity that quietly replaced its NPP PDF on February 15, 2026 without posting or notifying has not met § 164.520(c).

7. Regulatory Documentation Retention

Under 45 CFR § 164.520(e) and the general administrative documentation standards of 45 CFR § 164.530(j), covered entities must retain compliance documentation for a minimum of six (6) years from the date of its creation or the date when it last was in effect, whichever is later. Retained documentation includes:

1. Copies of all notices of privacy practices issued, including every historical revision with its corresponding effective date.
2. Written acknowledgments of receipt signed by individuals.
3. Documented good faith efforts and reasons why acknowledgments could not be obtained.

---

Exam Tips and Candidate Traps

[!IMPORTANT] NPP Acknowledgment vs. HIPAA Consent vs. Authorization: On the CHPS exam, question writers intentionally blur these three legal concepts. An Acknowledgment of Receipt merely confirms the patient received the notice; it does not authorize any release of records. A Consent was an optional mechanism eliminated under the 2002 HIPAA amendments (TPO does not require patient consent). An Authorization is a detailed, legally binding document required under § 164.508 for non-TPO uses (e.g., marketing, research, sale of PHI, legal releases).

[!TIP] Health Plans Never Collect Acknowledgments: When an exam vignette describes a health insurance company or HMO enrolling new subscribers, distractors frequently claim the health plan violated HIPAA by failing to obtain signed acknowledgment receipts. Remember: Only direct healthcare treatment providers have the good faith acknowledgment mandate. Health plans distribute notices at enrollment and every 3 years, but never collect signed receipts.

[!WARNING] Emergency Department Registration Workflows: If an ER registration clerk halts triage or delays an emergency examination to force an acutely injured patient or their family to sign an NPP acknowledgment, the facility has committed both a HIPAA violation (§ 164.520(c)(2)(i)(B)) and an EMTALA violation. Emergency care always preempts privacy administrative formalities.