Estimated reading time: 18 minutes.
Summarize this article with ChatGPT
Protecting client privacy isn't just about HIPAA compliance. It's about building trust and showing your clients that you take their confidentiality seriously.
This is where the Notice of Privacy Practices (NPP) comes in.
Think of your NPP as a straightforward way to tell your clients, “I take your privacy seriously.” It spells out exactly how you use and protect their sensitive health information.
It might sound intimidating, but we'll walk you through what your NPP needs to say, what's changed recently (including a major update that took effect on February 16, 2026), how to make your NPP easily accessible to your clients, and what tool makes the whole process a breeze.
TL;DR: Your Notice of Privacy Practices (NPP) explains how you use and protect clients' health information. If you haven't updated yours recently, now is the time.
A new federal rule, effective February 16, 2026, changes how substance use disorder (SUD) records must be handled in your NPP. This update may apply even if you only receive SUD-related records from another provider. Your state may also have additional requirements that a generic NPP template doesn't cover.
The good news? You don't need to start from scratch. This guide shows what to include, what's changed, and how Hushmail makes it simple to keep your NPP current and compliant over time.
Protecting client privacy isn't just about HIPAA compliance. It's about building trust and showing your clients that you take their confidentiality seriously.
The NPP is like your practice's privacy rulebook. It's a clear, plain-language document that tells your clients:
What is Protected Health Information (PHI)?
Any information about a person's health that can identify them. This includes details about their physical or mental health, healthcare services, and healthcare payments. This information is protected if it's handled by healthcare providers, health plans, or related businesses.
Examples of PHI include: name, email address, Social Security number, acknowledgment that a person is your client, client notes from a telehealth session, diagnoses, and recommendations to join a support group.
Covered Entities (CE), with certain exceptions, are legally required to create and distribute an NPP under HIPAA's Privacy Rule.
Now, you're probably wondering: is your practice a Covered Entity?
The short answer is if you're a healthcare provider who engages in the electronic exchange of information to carry out financial or administrative activities related to healthcare, then you are a CE. This may include psychologists, dentists, chiropractors, doctors, and other practitioners.
| A healthcare provider | A health plan | A healthcare clearinghouse |
|---|---|---|
|
This includes providers such as:
…but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. |
This includes:
|
This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa. |
If you exchange emails with clients, accept insurance, or bill online, you are most likely a CE. But if you are not, that doesn't mean you should ignore HIPAA. Securing your clients' PHI remains important from a professional and ethical standpoint, and following HIPAA is a good way to ensure you provide adequate protection.
💡 Hushmail tip: Use this easy-to-use question-and-answer decision tool from CMS to determine whether your practice is a Covered Entity.
Whether you're a solo practitioner or a small healthcare practice, an NPP is important for the following reasons:
Learn more: What happens when a HIPAA complaint is filed against you?
👉 Important note: NPPs can differ depending on one's practice. Your small healthcare practice might need a slightly different NPP than someone else's. This can sometimes cause confusion, but here's why: your practice may handle different aspects of healthcare (e.g., treatment and care) while an insurer manages coverage and payments, and uses patient health information in unique ways.
Keep reading to learn what you should include in your NPP as a small healthcare practice or solo practitioner.
The 2016–2017 HIPAA audit showcases the challenges of creating a fully compliant NPP. While the audit was done a few years ago, here are some of the key takeaways that remain crucial when crafting an NPP today:
You definitely don't want to be one of those practices that get their NPPs wrong. For example, a mental health center failed to provide a privacy notice to a father and his minor daughter. The good news is that they acknowledged their mistake and revised their policies to ensure patients receive the notice before their assessment. The center also assured the Office for Civil Rights (OCR) that all staff involved in the daughter's care were informed of the changes.
Now, if you're a small healthcare practice, what should you make sure your NPP includes?
Here's a breakdown of the key elements of an NPP for small healthcare practices. Click here for a complete list of statements that must be included in your NPP.
Start your NPP with a header that clearly states, “This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.”
💡 Hushmail tip: This is the wording required by HIPAA. Copy and paste it into your header.
This is the date your NPP goes into effect. This is important in case you ever need to update it.
💡 Hushmail tip: Put this date under your header so it's easy to find.
This is a clear statement that you must follow HIPAA's privacy rules.
💡 Hushmail tip: Don't overthink this. Just use clear language like, “We are required by law to protect your health information and provide you with this Notice of our Privacy Practices.”
This is your commitment to notify clients if their protected health information is ever compromised in a data breach.
💡 Hushmail tip: HIPAA has very specific requirements for breach notifications. For example, the HIPAA Breach Notification Rule requires you to notify all affected clients by mail or email, without unreasonable delay and no later than 60 days following the discovery of a breach. However, be aware that state law may require you to notify them sooner, so check with your local jurisdiction.
This is the meat of your NPP. Explain in plain language:
💡 Hushmail tip: Think about ALL the ways you use client information, from appointment reminders to note-taking. Be as specific as possible.
HIPAA gives your clients specific rights, and you need to inform them of these rights. These include:
👉 New for 2026: If your practice handles SUD-related records protected by 42 CFR Part 2 (see the section below), your NPP should also inform clients of these additional rights:
💡 Hushmail tip: It's helpful to offer instructions on how your clients can exercise these rights (e.g., do they submit a form? Contact you directly?).
List the name and contact information of the person in your practice who is responsible for handling privacy questions or complaints.
💡 Hushmail tip: If you're a sole practitioner, this will likely be you!
HIPAA has strict rules about using PHI for marketing or selling it. You need to clearly state if you will (or will not) be doing those things.
💡 Hushmail tip: Most small practices won't be doing this, so a simple statement like, “We will not sell your information or use it for marketing without your written permission” is sufficient.
This section explains the process for filing a complaint if a client believes their privacy rights have been violated. You should state that clients have the right to file a complaint with the Department of Health and Human Services (HHS) and provide the Office for Civil Rights (OCR) contact information.
👉 New for 2026: If your practice handles SUD-related Part 2 records (see section below), your NPP should now also include that patients can file complaints about Part 2 violations directly with the Secretary of HHS. You should also include a no-retaliation statement, letting clients know they will not face consequences for filing a complaint.
💡 Hushmail tip: Include the contact information of your designated privacy officer or the appropriate person.
In addition to HIPAA, some practices must comply with a federal law known as 42 CFR Part 2. This regulation provides extra protections for substance use disorder (SUD) treatment records.
The rule, effective February 16, 2026, requires certain providers to update their NPPs to reflect these protections.
⚠️ Important clarification: Even if your practice does not directly provide SUD treatment, Part 2 may still apply if you receive SUD records from another provider that is subject to 42 CFR Part 2. For example, a rehab discharge summary or medication-assisted treatment records.
Don't panic. You can figure this out by answering a few simple questions.
The regulation distinguishes three categories of providers. Here's a simplified breakdown:
| Category | Who it applies to | What it means for your NPP |
|---|---|---|
| Part 2 Program | You provide and advertise SUD diagnosis, treatment, or referral as a core service. | You'll need to follow the full set of Part 2 rules. NPP must include Part 2 language. |
| Lawful Holder | You don't treat SUD, but you receive Part 2-protected records from another provider (e.g., rehab discharge summaries). | You'll need to follow stricter rules around resharing and legal proceedings. NPP should reflect the stricter Part 2 limits. |
| Outside Part 2 | You don't provide SUD services and don't receive Part 2 records. | You don't need to add any Part 2 language. |
If you fall into the Part 2 Program or Lawful Holder category, your NPP needs to address several new areas. Here's the high-level picture (for specific sample language, see the HHS fact sheet on the Part 2 Final Rule and the HHS model NPP templates):
💡 Hushmail tip: You can combine your HIPAA NPP and Part 2 Patient Notice into one document. You do not need to create a separate document. HHS has clarified that as long as the combined document includes all required elements under both 45 CFR 164.520 and 42 CFR 2.22, it meets the legal requirements. This way, a single document covers everything.
If all of this feels overwhelming, you're not alone. The intersection of HIPAA and 42 CFR Part 2 can be complex, especially with the 2026 updates. Fortunately, there are reliable resources available to help you get it right.
The HHS fact sheet on the 42 CFR Part 2 Final Rule and the HHS model NPP templates are helpful starting points. Person Centered Tech also offers a free decision guide with a step-by-step decision flow and sample NPP language by category.
When in doubt, have your final NPP language reviewed by a qualified attorney who understands both HIPAA and Part 2.
💡 Hushmail tip: When your NPP needs updating, whether for Part 2 or any other reason, Hushmail's secure, editable forms mean you update the language once. Every new client will automatically get the current version. This eliminates the need to chase down PDFs or worry about which version a client signed.
👉 A note on psychotherapy notes and SUD counseling notes: Psychotherapy notes are already subject to special protections under HIPAA and generally require separate authorization for most disclosures. SUD counseling notes that fall under 42 CFR Part 2 may have additional or overlapping protections. Make sure your NPP clearly explains how these types of records are handled in your practice.
HIPAA is the floor, not the ceiling. Your state may impose stricter requirements, and your NPP needs to reflect them.
The federal government's model NPP templates instruct covered entities to describe any state or other laws that provide for additional limits on disclosures. If your state has stricter rules, your NPP must say so.
Your local professional association chapter is the best starting point for understanding your state's specific requirements.
💡 Hushmail tip: When state rules change, you update your form once in Hushmail. No resending PDFs or tracking which version a client received.
Here's a rundown of things that should NOT be included in your NPP:
Starting on February 16, 2026, you are no longer required to obtain a signed acknowledgment from clients confirming receipt of your NPP. However, documenting that you provided the NPP remains a best practice.
💡 Hushmail tip: Continue documenting NPP distribution: While a signature on an acknowledgment form is no longer required, it's still a great way to show your clients received the NPP. Hushmail helps you keep track with e-signatures or form submission activity.
When you update your NPP, you do not need to send the new version to every existing client. However, you should make the updated NPP accessible and provide it as needed. You should:
This applies whether you're updating for Part 2, a state law change, or any other reason.
Your next step is to understand when to provide your NPP, where to keep it visible, and how to give it to your clients.
When to give your NPP to clients
Give new clients a copy of your NPP during their first visit or as part of their welcome packet.
If you have to treat someone during an emergency situation, give them the NPP as soon as possible afterward.
💡 Hushmail tip: If you make any changes in how you handle PHI, you need to update your NPP.
Make your NPP available
Keep copies of your NPP at your office and prominently posted on your website.
If a client asks, you must give them a copy of your NPP.
Place a copy of your NPP in a prominent place in your waiting area or office.
Design tips for your NPP
When regulations change, like the February 2026 Part 2 deadline, having editable, centralized forms means you update once and move on. That's exactly what Hushmail for Healthcare provides.
With e-signatures
If your Hushmail plan includes electronic signatures, you can:
Without e-signatures
If your plan doesn't include e-signatures, you can still deliver your NPP and collect acknowledgments:
HIPAA compliance isn't just about avoiding fines. It's about building the kind of trust that makes your practice thrive. A clear, up-to-date NPP is a powerful way to show your clients that their privacy is in good hands.
“We prioritize our clients' safety and trust. Hushmail offers encrypted email services and web forms, ensuring the confidentiality and security of our client information. With Hushmail, our clients can rest assured that their journey with us is in a secure, protected space.”
Dr. Josh Littleton CST, LMHC
Florida Division Vice-President
Excelsis Behavioural Health
Here's your next step:
When you're ready, Hushmail makes it realistic to keep your forms current without rebuilding everything from scratch.
Reviewed by: Steven O. Youngman, VP of Legal and Compliance, Hushmail.