A Notice of Privacy Practices is not optional paperwork. Under 45 CFR §164.520, every covered entity, a healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically in connection with a covered transaction, has to give patients a written notice describing how it uses and discloses their Protected Health Information (PHI), and it has to post that notice somewhere patients can actually find it, not just hand it over once at intake and file it away. For a solo practitioner or a small clinic without a compliance department, the notice is usually adapted from a template that was written for a hospital system, which means it drags in sections that don’t apply and skips details the practice’s specific PHI uses actually require. Here’s what the notice needs to say, section by section, for a small practice.
Who Has to Issue One, and When
The Notice of Privacy Practices requirement applies to “covered entities” under HIPAA: healthcare providers who transmit health information electronically for billing or eligibility checks (which covers nearly every practice that bills insurance, even indirectly through a clearinghouse), health plans, and healthcare clearinghouses. A cash-only practice that never transmits a covered electronic transaction is a narrow exception, but most practices, including small ones, fall inside the requirement the moment they submit an electronic claim.
The notice has to be given to every new patient at the first date of service, posted in a clear and prominent location at the physical practice (usually the waiting room), and posted on the practice’s website if it has one. A practice also has to make a good-faith effort to get a written acknowledgment that the patient received the notice, and if the practice can’t get one (a patient refuses to sign, or the visit is a phone consult with no in-person moment to collect a signature), it has to document the attempt. None of that requires a lawyer to design, but skipping the acknowledgment step is one of the more common gaps an OCR audit finds, because it’s easy to hand someone a clipboard on their first visit and never check whether the signed form actually made it into the file.
What Belongs in the Notice: PHI Uses and Disclosures
The core of the notice is a plain-language explanation of how the practice uses and discloses PHI, organized around a distinction that matters more than it looks: some uses don’t require the patient’s written authorization, and everything else does.
PHI uses: authorization required or not
| Requires authorization? | Examples | |
|---|---|---|
| Treatment, payment, operations | No | Care coordination, billing, QA review |
| Public health, legal, safety | No | Abuse reports, court orders, safety |
| Research (with IRB/Privacy Board waiver) | No, if waived | De-identified or waiver-covered studies |
| Fundraising communications | No, opt-out only | Practice newsletter asking for donations |
| Marketing | Yes | Third-party marketing using patient PHI |
| Sale of PHI | Yes | Any PHI transfer for payment |
| Psychotherapy notes | Yes | Separately kept therapy session notes |
The treatment, payment, and healthcare operations (TPO) category covers the everyday work of running a practice and doesn’t require a signed authorization for each instance, which is why it’s usually the first substantive section of the notice. The “requires authorization” column is the part small practices most often get wrong by omission: if the practice ever plans to use patient information for a third-party marketing arrangement, or if it might in the future sell any PHI in the sense HIPAA defines “sale” (which is broader than a cash transaction and includes most remuneration for PHI), the notice has to say so and describe the authorization process, not stay silent and rely on getting a one-off consent later. If the practice doesn’t do any of that, the notice should say plainly that it doesn’t, which closes off the question rather than leaving it ambiguous.
A small practice also needs to decide, deliberately, whether its notice covers research, fundraising, and any special categories of information it actually handles, mental health records, substance use disorder records (which carry additional protection under 42 CFR Part 2 beyond standard HIPAA), or HIV-related information subject to state confidentiality law. These aren’t boilerplate options to leave checked by default from a downloaded template; they should reflect what the practice actually does, because a notice that claims research or fundraising activity the practice never engages in is confusing at best and creates an unnecessary compliance obligation (an actual opt-out mechanism) at worst.
What Belongs in the Notice: Patient Rights
The second half of the notice states the rights patients have over their own PHI, and each right has a specific, defined mechanic rather than a vague assurance.
The right to access (45 CFR §164.524) lets a patient inspect and get a copy of their PHI in the practice’s designated record set, and the practice has 30 days to respond (60 with one 30-day extension for records held off-site), for a reasonable, cost-based fee. If the practice offers electronic records, the notice should say patients can request an electronic copy at no additional cost for the first copy, since that’s a right under the HITECH amendments many older templates leave out entirely. The right to amend (45 CFR §164.526) lets a patient request a correction to their record, which the practice can deny in specific circumstances (the information is accurate, wasn’t created by the practice, or isn’t part of the record used to make decisions about the patient), but the denial has to follow a defined process, not a silent no.
The right to an accounting of disclosures (45 CFR §164.528) covers a list of certain disclosures made outside routine TPO activity, typically for the prior six years, and the first request in any 12-month period is free. The right to request restrictions (45 CFR §164.522(a)) lets a patient ask the practice to limit certain uses; the practice doesn’t have to agree except in one specific case it must honor, a patient who paid out of pocket in full can require the practice not to disclose that service to their health plan. The right to confidential communications (45 CFR §164.522(b)) lets a patient request contact through an alternate method or address, and the right to a paper copy (45 CFR §164.520(c)(1)) means a patient can always ask for a physical copy even after agreeing to receive the notice electronically.
Breach Notification and the Privacy Officer
The notice has to state that the practice will notify affected patients if their unsecured PHI is breached, and within what timeframe, generally within 60 days of discovering the breach under 45 CFR §164.404. This is a promise the notice makes on the practice’s behalf, so the practice’s actual incident response process needs to be able to meet that number before it goes in writing.
Every notice also needs a named privacy officer with real contact information: a name, not just a department or a generic “compliance” inbox, a direct phone number, and an email address. For a small practice this is often the office manager or the practice owner wearing a second hat, and that’s fine under HIPAA, there’s no requirement that the privacy officer be a dedicated full-time role or hold a particular credential. What matters is that the name and contact details in the notice are current and actually reach someone who can respond to a patient’s request to exercise their rights, not a generic front-desk line that changes staff every few months without the notice being updated to match.
The notice closes with a complaints section: patients can file a complaint with the practice directly or with the HHS Office for Civil Rights, and the practice cannot retaliate against a patient for filing one (45 CFR §164.530(g)). That non-retaliation line is short but it’s a required statement, not an optional courtesy, and it’s worth double-checking it’s actually in the final draft since it’s easy to drop when a template gets trimmed down for a smaller practice.
Putting a Small Practice’s Notice Together
A complete notice, in the order patients actually read it, states: what PHI is and the practice’s legal duty to protect it, how PHI is used and disclosed with the authorization line drawn clearly, the specific patient rights and how to exercise each one, the breach notification commitment, how the notice can change over time, and where to send a complaint. None of the individual sections is long, but each one has a specific regulatory citation behind it, which is why a notice assembled by editing a generic hospital template tends to either overstate what a small practice does (listing research and fundraising activity that doesn’t exist) or understate what it needs to disclose (skipping the electronic access right or leaving the accounting-of-disclosures window blank).
A Notice of Privacy Practices is one piece of a small practice’s compliance picture, not the whole of it; most practices also need an employee handbook covering how staff are expected to handle PHI day to day; our guide on writing an employee handbook for a small business covers the HR side of that. If the practice works with an outside billing service, EHR vendor, or transcription contractor who touches PHI on its behalf, that relationship needs a Business Associate Agreement, a HIPAA-specific cousin of the data processing agreements covered in whether you need a data processing agreement, since a signed BAA is what makes a vendor’s own privacy failure the vendor’s liability rather than the practice’s.
Our HIPAA Notice of Privacy Practices generator builds the notice from a short set of questions about the practice’s entity type and PHI uses, mental health, substance use, or HIV-related records included, so the authorization language, patient rights section, and breach notification timeline are populated correctly for what the practice actually does, rather than left over from whatever template it started from.