BlogGuide

Notice of Privacy Practices Template: Every HIPAA Element, Checked

A notice of privacy practices template checked against 45 CFR 164.520, read at the source: each required element, the 2026 update, a filled summary.

By MakeOnepagers Team

Updated October 14, 2026 · 10 min read

A notice of privacy practices template gives a HIPAA covered entity, such as a clinic, a dental office or a health plan, a fixed list of what its notice must say: a required header, how health information is used and shared, the patient's rights, the entity's duties, how to complain, a contact and an effective date. Those come from the HIPAA Privacy Rule, 45 CFR 164.520. We read the rule on eCFR on 12 October 2026, checked our own one-page notice summary against every required statement, and list what it covers and what it leaves out.

Real One-Pagers made with MakeOnepagers. Open any one to edit it as your own.

This is a guide to what the rule says, not legal advice. Have your own notice reviewed for your practice or plan.

What is a notice of privacy practices?

A notice of privacy practices (NPP) is the document a HIPAA covered entity gives people to explain how it may use and share their protected health information, what rights they have, and what the entity must do. The rule frames it as a right: an individual "has a right to adequate notice" of those uses and disclosures, their rights and the entity's legal duties (164.520(a)(1)).

The rule also sets the tone. The notice must be "written in plain language" (164.520(b)(1)).

What changed in 2026

Two changes matter if you are updating an older notice.

Substance use disorder records. HHS's model notices page says that as of 16 February 2026, covered entities must include information about substance use disorder patient records covered by 42 CFR part 2 in their notice. HHS published revised model notices in February 2026 for providers, for health plans and for Part 2 programs.
Reproductive health care. A 2024 rule added notice statements on reproductive health care. HHS says that on 18 June 2025 a federal court in Texas vacated most of that rule. eCFR still prints two of those items, (b)(1)(ii)(F) and (G), and HHS describes its 2026 models as reflecting only the rule's Part 2-related provisions. Ask your counsel which version of those items your notice needs.

The required elements of a notice, in the rule's order

Paragraph (b)(1) lists what the notice must contain. Here are the core statements, by paragraph, in plain words.

(i) The header

The notice must carry this statement "as a header or otherwise prominently displayed":

"THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

Copy it exactly. It is the one part of the notice whose words you do not choose.

(ii) Uses and disclosures

Item	What the notice must say
(A)	How you use and share information for treatment, payment and health care operations, with at least one example for each
(B)	Each other purpose for which you may use or share it without the person's written authorization
(C) and (D)	Where another law, such as 42 CFR part 2, is stricter, describe the stricter rule, in enough detail to put the person on notice
(E)	The uses that need written authorization, that other uses not in the notice need written authorization, and that the person may revoke an authorization
(H)	That information you disclose may be redisclosed by the recipient and no longer protected by the rule

(iii) Separate statements, only if they apply

If you do any of these, the rule asks for a separate statement: contacting people to raise funds, with their right to opt out; a group health plan sharing information with the plan sponsor; a health plan that uses information for underwriting, stating it may not use genetic information for that; and the limits on using substance use disorder records in proceedings against the person, or for fundraising.

(iv) The person's rights

The notice must state six rights and briefly say how to use each:

To ask for limits on certain uses and disclosures, with a statement that you are not required to agree, except in one case set by the rule.
To receive communications confidentially, for example at another address or phone number.
To inspect and get a copy of their information.
To ask for it to be amended.
To receive an accounting of disclosures.
To get a paper copy of the notice on request, even after agreeing to an electronic one.

(v) Your duties

Three statements: that you are required by law to keep the information private, to give the notice and to notify people after a breach of unsecured information; that you must follow the notice currently in effect; and, if you want changes to apply to information you already hold, that you reserve the right to change the notice, with how people will get the revised one.

(vi), (vii) and (viii) Complaints, contact and date

Complaints: that people may complain to you and to the Secretary of Health and Human Services, briefly how to complain to you, and that you will not retaliate.
Contact: the name or title, and the phone number, of a person or office for more information.
Effective date: the date the notice first takes effect, which "may not be earlier than the date on which the notice is printed or otherwise published".

A notice of privacy practices summary example

Edit this template

A sample family clinic's notice on one page: the required header, then uses, rights and duties in three columns, and a contact row.

What to notice:

The header is exact and set apart, in its own box under "Please Read".
Each of treatment, payment and operations has a real example, as (ii)(A) asks: "your doctor shares your test results with the specialist you are referred to."
All six rights are there, in everyday words. "Ask us to limit what we use or share. We do not always have to agree."
The three duties are there, including how a revised notice reaches patients: "at the front desk and on our website."
The bottom row has the complaint line, the privacy officer's phone and the effective date.
The footer says what the sheet is: a summary, and the full notice must also be available.

The clinic is a sample. Open it as a template: notice of privacy practices summary template.

We checked our template against 164.520(b)(1)

We read our summary sheet against the 17 core statements above on 12 October 2026: the header, the four uses-and-disclosures statements (A, B, E and H), the six rights, the three duties, complaints, contact and the effective date. We left out (C) and (D), which shape how other statements are written; (F) and (G), covered in the 2026 changes above; and (iii), which only applies to some entities.

Result	Count	Statements
Covered in full	13 of 17	The header; treatment, payment and operations with examples; all 6 rights; all 3 duties; the contact; the effective date
Covered in part	2 of 17	Other purposes (B): one example, then "The full notice lists every case". Complaints (vi): to whom, and no retaliation, but not how to complain to the clinic
Not on the sheet	2 of 17	Uses that need written authorization and the right to revoke it (E); the redisclosure statement (H)

So the summary does what it says: it is a readable front page, not the whole notice. If you use it, keep the full notice available, as its footer says, and add three short lines if you have room: one for authorizations, one for redisclosure, and one on how to file a complaint with you.

How a notice has to be provided

Paragraph (c) sets who gets the notice and when. For a provider with a direct treatment relationship:

Duty	What the rule says
When to give it	No later than the first service delivery, including one delivered electronically, or as soon as practicable after an emergency
Acknowledgment	Make a good faith effort to get a written acknowledgment of receipt, and document why if you could not
At your office	Have it available to take away, and post it "in a clear and prominent location"
On your website	Post it prominently if your website describes your services or benefits
By email	Allowed if the person agrees, with a paper copy if the email fails

Health plans give it at enrollment and must tell members at least once every three years that it is available and how to get it. Anyone, patient or not, may ask for a copy.

How to write a notice of privacy practices in 6 steps

Start from the HHS model notice for providers, health plans or Part 2 programs, revised February 2026.
Fill in your details: your name, the privacy contact's name or title and phone, and your effective date.
Check every (b)(1) statement against the lists above. Add the separate statements in (iii) only if you do those things.
Write it plainly. The rule asks for plain language, and short sentences and everyday words do the work.
Make a one-page summary for the front desk and your website, with the header, uses, rights, duties and contact on it, and the full notice beside it.
Post, hand out and record. Give it at the first visit, ask for the acknowledgment, post it in the office and on the website, and revise it promptly after any material change.

Have a long notice that patients skip? Paste it into the free AI One-Pager generator to get a one-page summary back, then check every statement against the rule and the full notice before you use it.

Other one-page handouts a clinic gives patients

The privacy notice is rarely the only sheet handed over at the front desk.

Edit this template

A sample patient handout: the one thing to remember at the top, then short numbered steps, dos and don'ts and when to call.

Notice of privacy practices mistakes

Mistake	Fix
Rewording the header	Copy the required statement exactly
Treatment, payment and operations with no examples	Give at least one example for each, as (ii)(A) asks
A notice still dated before 16 February 2026	Add the substance use disorder records statements and a new effective date
An effective date earlier than the print date	The rule does not allow it. Use the publication date or later
"Contact our office"	A name or title and a phone number
A summary handed out instead of the notice	Keep the full notice available, posted and on the website

Make your notice of privacy practices summary

Open the free notice of privacy practices summary template, replace the sample clinic with your name, contact and effective date, add the authorization, redisclosure and complaint lines, and print it for the front desk next to your full notice.

Frequently asked questions

What must be included in a notice of privacy practices?

Under 45 CFR 164.520(b)(1): the required header; how information is used and shared for treatment, payment and operations, with examples; other uses without authorization; uses that need authorization and the right to revoke; a redisclosure statement; six individual rights; three statements of your duties; how to complain; a contact; and the effective date. Some entities also need separate statements under (iii).

Is there an official notice of privacy practices template?

Yes. HHS publishes model notices for health care providers, health plans and Part 2 programs, revised in February 2026. Entities can use them by entering their own details.

Does a patient have to sign the notice of privacy practices?

No. The provider must make a good faith effort to get a written acknowledgment that the patient received it, and document the reason if it could not.

Where should a notice of privacy practices be posted?

A provider with an office posts it in a clear and prominent location where patients can read it, and keeps copies to take away. Any covered entity whose website describes its services or benefits must post it prominently there too.

Can a notice of privacy practices be one page?

A full notice has to carry every statement above, which rarely fits on one page. A one-page summary works as the front page people read first, as long as the full notice is available beside it.

Found this useful? Share it

Notice of Privacy Practices Template: Every HIPAA Element, Checked

What is a notice of privacy practices?

What changed in 2026