Notice of Privacy Practices for Therapy Practices: HIPAA PDF and Checklist

For the current official downloadable provider model, start with HHS’s Model Notices of Privacy Practices, including its revised February 2026 HIPAA Health Care Provider NPP. That official model is different from the Emosapien checklist: the model is a notice template to adapt, while the checklist is an organizing aid.

Required element	What it says	Therapy-practice note
Required header	The notice must prominently state that it describes how medical information may be used and disclosed and how a person can access it	Use the required federal header or an equivalent prominent presentation in the approved notice
Uses and disclosures	The principal uses and disclosures the practice may make, with examples where required	Include treatment, payment, operations, required-by-law disclosures, and the other categories that fit your workflow
Uses and disclosures needing authorization	Uses and disclosures that require authorization, the written-authorization rule for other uses not described in the notice, and the individual’s right to revoke an authorization as provided by § 164.508(b)(5)	Explain when authorization is required, including relevant marketing, psychotherapy-notes, and sale-of-PHI rules; state how an individual may revoke an authorization; do not treat the NPP as an authorization
Individual rights	Rights such as access, amendment, confidential communications, restrictions, and an accounting of disclosures, as applicable	Name the practice contact and process instead of promising an inbox no one monitors
Practice duties	The practice’s duties to maintain privacy, provide the notice, notify affected people after a breach when required, and follow its current terms	State that the practice will follow the notice currently in effect and explain any permitted change-to-prior-information statement
Complaint route	How a person can complain to the practice and to the Secretary of HHS without retaliation	Include a working practice contact and the HHS complaint link or contact information required by your approved notice
Contact information	The person or office to contact about the notice or privacy practices	Use a role mailbox or monitored phone line that remains staffed during absences
Effective date	The date the notice takes effect	Keep a version history and retain prior versions according to your records policy
Material revisions	How the practice will make a revised notice available	Update the posted copy and tell clients how to request the current notice
Part 2 and separate statements	Conditional statements required when the practice is subject to applicable substance-use-disorder confidentiality or other separate requirements	Ask privacy counsel whether a combined notice or a separate statement is required for your services and records

Current-law note (checked October 19, 2026): HHS states that the June 18, 2025 court order vacated 45 CFR 164.520(b)(1)(ii)(F), (G), and (H), the reproductive-health NPP provisions concerning prohibited uses or disclosures, attestations, and the related redisclosure notice. Do not treat those three vacated provisions as currently required elements of a therapy-practice NPP solely because older codified text or model language lists them. HHS also states that the remaining NPP modifications remain in effect, including applicable substance-use-disorder (SUD) and Part 2 notice duties; have your privacy lead or counsel confirm the current requirements for your practice.

The example is filled so you can see the level of specificity a notice needs. It is not a federal form and is not ready to use unchanged. Replace the practice identity, effective date, services, contacts, and disclosures with facts that match your workflow. Do not use a made-up email address or a promise your practice cannot keep.

Educational resource for US mental-health clinicians. Have your privacy lead or counsel review the notice against your practice, state law, payer contracts, and current federal guidance before distribution.

What a notice of privacy practices does

A notice of privacy practices (NPP) tells clients how your practice may use and disclose protected health information (PHI), what rights they have, and what duties your practice accepts. If a colleague asks for a notice of privacy practices HIPAA PDF free download, explain that a generic file is only a drafting aid and is not ready for distribution until it matches the practice. Start with the federal baseline at 45 CFR 164.520, then build a practice-specific document rather than relying on a generic form. Read the regulation for the complete requirements and exceptions, and have your privacy lead or counsel resolve questions before distribution.

Keep the NPP distinct from the documents around it. A privacy notice explains your information practices. Use the HIPAA consent form sample for the TPO-consent distinction, the HIPAA authorization guide when a specific disclosure needs authorization, and the HIPAA compliance guide for solo practitioners to coordinate the notice with your broader compliance workflow.

The regulation’s details control if the table and your draft differ. Ask counsel or your privacy lead to resolve any mismatch before publication.

Draft the uses and disclosures section

Start with the work your practice really performs. Group the explanation so a client can see why information might move, not just which legal words appear on the page.

Treatment, payment, and health care operations

Describe ordinary care coordination, billing, claims, quality review, scheduling, credentialing, training, and other operations only when they reflect your practice. If you use a telehealth platform, portal, transcription service, AI tool, or cloud host that handles PHI, check its role and your business associate agreement before describing the workflow.

Do not say that a vendor is “HIPAA compliant” as a substitute for describing your own practices. Your notice should match your configuration, access controls, contracts, and data flows.

Other permitted or required disclosures

Your approved notice may need to explain disclosures required by law, public-health activities, oversight activities, court or administrative proceedings, law enforcement, workers’ compensation, and other categories in the rule. The exact language and exceptions matter. Use 45 CFR 164.520 as the source and have a reviewer check each category against your practice.

Uses that need a separate authorization

A notice does not authorize every disclosure. Marketing, psychotherapy notes, sale of PHI, and other situations have specific rules. When a planned use or disclosure needs permission, route it through the authorization process rather than hiding it in a broad notice. Keep the HIPAA authorization requirements beside your privacy workflow.

Explain client rights in usable language

Write the rights section so a client can act on it. For each right, identify the practice contact, the request path, and any response or review process required by the rule.

• Access: Explain how a client requests a copy or access to PHI in the designated record set and where the request goes.
• Amendment: Explain how a client asks to amend information and who reviews the request.
• Confidential communications: Explain how a client requests communication by an alternative method or at an alternative location.
• Restrictions: Explain how a client asks for a restriction and any limits on what the practice must agree to.
• Accounting: Explain how a client requests an accounting of certain disclosures when the right applies.
• Copy of the notice: Explain how a client can request a paper or electronic copy.
• Complaint: Give a practice contact and explain that a person may complain to HHS without retaliation.

Use your actual portal, mail, phone, and in-person options. A right is not operationally explained if the client cannot tell where to send the request.

Distribution, acknowledgment, and posting workflow

The notice is part of your intake and public-facing practice workflow. Build the handoff before you publish the PDF, even if your draft began as a notice of privacy practices HIPAA PDF free download.

Workflow checkpoint	What to do	Evidence to keep
First service delivery	For a direct-treatment provider, provide the notice no later than the first service delivery; in an emergency treatment situation, provide it as soon as reasonably practicable after the emergency	Version provided, date, delivery method, and acknowledgment status
Good-faith effort	If acknowledgment is required and not obtained, document the good-faith effort and why acknowledgment was not obtained	Signed acknowledgment, refusal note, or documented attempts
Public posting	Keep the current notice available at the physical site, if the practice has one, and on the practice website when required	Posted URL, print location, and version date
Revised notice	Make a revised notice available by the effective date and update copies and links	Approval record, change log, new PDF, and old-version archive
Client request	Provide a copy when a person asks, using the available delivery method	Request date, version delivered, and delivery record
Staff workflow	Train staff and contractors on where the current notice lives and how to route questions	Training date, attendees, and owner of the current file

Do not backfill a signature that was never obtained. Document the attempt and use the current approved process for the next service interaction. Your reviewer should confirm the precise acknowledgment and posting requirements in 45 CFR 164.520.

Use the HHS model notices as a drafting aid

HHS publishes model notices of privacy practices that covered entities may adapt. If your privacy lead or counsel selects one as a drafting aid, compare its structure, headings, and plain-language presentation with the requirements in 45 CFR 164.520. Treat any model as a starting point, not as a substitute for practice-specific review. Choose only a model that fits your setting, then adapt it to your actual services, contacts, uses, disclosures, and rights-request process.

Before you adopt a model notice, check each statement against your own facts:

1. Replace the practice name, address, phone, email, Privacy Officer, and complaint route.
2. Mark which services you provide: in-person, telehealth, group work, records requests, billing, or other services.
3. Confirm which vendors, portals, cloud systems, and contractors may handle PHI.
4. Remove examples your practice does not use and add disclosures your reviewer says must be explained.
5. Add the effective date, revision process, and copy-request path.
6. Ask your privacy lead or counsel to approve the final PDF and web copy as one version.

Do not reprint a model notice as if it were your practice’s notice. Maintain your own approved copy and confirm the current model source with your privacy lead or counsel.

Use the downloadable checklist to organize the draft, but keep the notice itself specific to your practice and current workflow.

Filled example: a revision checkpoint

A change record helps you show which notice was approved and where it was distributed. It does not prove that the content is legally sufficient. Recheck the notice whenever your services, vendors, locations, contact route, or disclosure practices materially change.

Download the notice of privacy practices checklist

A notice of privacy practices HIPAA PDF free download gives you a generic form. The Notice of Privacy Practices Checklist helps you review required elements, client rights, distribution, posting, revision control, and the HHS model notices before you release a PDF. Use it as a practice worksheet, not as a certification.

Complete the checklist as the handoff: attach the approved notice, record its version and distribution evidence, and name the file clearly enough that staff can distinguish the current copy from a draft. The download is a starting point; your practice still needs to add its contacts, workflows, disclosures, and required statements.

If your team starts from a notice of privacy practices HIPAA PDF free download or another template, use this checklist to verify the practice-specific details before anyone distributes the notice. Treat the template as a starting document, not as proof that the practice meets every federal or state requirement.

How Emosapien fits the privacy workflow

Emosapien supports mental-health clinicians with a review-first documentation workflow. Product safeguards, access controls, and audit-oriented features are described on the security page. Your notice of privacy practices still belongs to your practice: you own the approved language, client communication, vendor review, and change log.

If your practice uses Emosapien or another tool with PHI, review the service configuration and agreement with the rest of your vendor inventory. Software can support documentation; it does not replace your privacy notice, risk analysis, or counsel review. Keep the approved notice separate from any template used only for drafting.

Closing checklist

• Practice identity, contact route, and effective date are accurate
• Uses and disclosures match the services, vendors, and workflows you actually run
• Client rights have a usable request path and owner
• Complaint route and no-retaliation language were reviewed
• Current notice is posted and copies are available through the approved channels
• Acknowledgment and good-faith-effort workflow is documented
• HHS model language was adapted rather than copied without review
• Revision history, approval record, and distribution evidence are stored
• Privacy lead or counsel reviewed the final version for your facts

References

• Cornell Law School, Legal Information Institute. (n.d.). 45 C.F.R. § 164.520—Notice of privacy practices for protected health information.
• U.S. Department of Health and Human Services. (n.d.). Model notices of privacy practices.