Notice of Privacy Practices: HIPAA Rules and Your Website

A notice of privacy practices (NPP) is the document HIPAA requires most covered entities to give patients, explaining how the entity may use and disclose their protected health information (PHI), their rights, and its legal duties, under 45 CFR 164.520. The rule gives the patient "a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity" (eCFR), and a covered entity with a website about its services must post the notice prominently on that site. Curve Compliance's free website scan shows which trackers run on the same pages, and Curve signs a BAA on every plan.

Book a call. Curve Compliance strips PHI before data reaches an ad platform, and Curve's team does the setup. Book a call with Curve.

What a notice of privacy practices must include

The notice must be "written in plain language" and contain the elements in 164.520(b) (eCFR). HHS summarizes it as how the entity may use and disclose PHI, the patient's rights and how to use them, the entity's legal duties, and whom to contact (HHS). The required elements include:

Element	What 45 CFR 164.520(b) requires
Header	The statement "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY." as a header or prominently displayed (eCFR)
Treatment, payment and operations	A description, "including at least one example," of the uses and disclosures allowed for each (eCFR). See HIPAA TPO.
Other uses without authorization	"A description of each of the other purposes" the entity may use or disclose PHI for without written authorization (eCFR)
Authorization statement	A description of the uses that need an authorization under 164.508(a)(2) to (a)(4), such as marketing and the sale of PHI, a statement "that other uses and disclosures not described in the notice will be made only with the individual's written authorization," and that an authorization can be revoked (eCFR)
Separate statements	Required when they apply, for example fundraising contacts with a right to opt out, and limits on using substance use disorder records in proceedings (eCFR)
Patient rights	Restrictions, confidential communications, inspecting and copying, amending, an accounting of disclosures, and a paper copy of the notice (eCFR)
Your duties	That the entity must keep PHI private, give this notice, notify affected individuals after a breach of unsecured PHI, and follow the notice in effect (eCFR)
Complaints, contact, date	How to complain to the entity and to HHS without retaliation, a contact person or office with a phone number, and the effective date (eCFR)

A notice may also describe narrower practices than the rule allows, as an optional element, and it must be revised promptly "whenever there is a material change" to the uses, rights, duties or other practices it states (eCFR). Enforcement covers content too. In a resolution agreement with New Vision Dental, HHS's investigation indicated the practice "failed to have the minimum content required in its Notice of Privacy Practices" (HHS).

The website rule

Section 164.520(c)(3)(i) is short: "A covered entity that maintains a web site that provides information about the covered entity's customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the web site" (eCFR). HHS says the same in its guidance (HHS). Prominently is the operative word.

• Telehealth and online first visits. If the first service is delivered electronically, the provider "must provide electronic notice automatically and contemporaneously in response to the individual's first request for service" (eCFR).
• Email delivery. Allowed "if the individual agrees to electronic notice and such agreement has not been withdrawn," with a paper copy if the email fails (eCFR).
• Offices. A provider with a physical site must have the notice there to take away and post it "in a clear and prominent location" (eCFR).
• Acknowledgment. Outside emergencies, a provider with a direct treatment relationship must make "a good faith effort to obtain a written acknowledgment of receipt of the notice" and document it if that fails (eCFR).

Not every covered entity needs a notice. HHS lists clearinghouses that handle PHI only as a business associate, correctional institutions, and some fully insured group health plans as exceptions (HHS).

The February 16, 2026 update

The latest change came from the 2024 rules on substance use disorder (SUD) records. HHS says: "As of February 16, 2026, these HIPAA covered entities are required to include information about substance use disorder (SUD) patient records" in their notice of privacy practices, meaning records covered by 42 CFR part 2 (HHS). The Part 2 rule also "Aligns Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices," and its fact sheet says those subject to it "must comply with the applicable requirements of the final rule by February 16, 2026" (HHS).

The current text of 164.520 reflects this. It refers to records "subject to 42 U.S.C. 290dd-2" and requires a separate statement that SUD records from a Part 2 program "shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual" without written consent or a qualifying court order (eCFR). If your notice predates 2026, check it against this. eCFR still prints three more notice elements added by the 2024 reproductive health care privacy rule, 164.520(b)(1)(ii)(F), (G) and (H). HHS says a federal court "vacated only the provisions that were deemed unlawful, namely 164.520(b)(1)(ii)(F), (G), and (H)," on June 18, 2025, and that "The remaining modifications to the NPP requirements are undisturbed and remain in effect" (HHS; opinion). For the wider 2026 picture, see the new HIPAA rule in 2026.

NPP vs website privacy policy vs cookie banner

Health websites often carry three documents that sound alike. Only one is the HIPAA notice, and none of them permits sending PHI to a tracking vendor.

Document	What it is	What HHS says about tracking
Notice of privacy practices	The HIPAA notice under 164.520, describing uses, rights and duties (eCFR)	Listing tracking in a "privacy policy, notice, or terms and conditions of use" is not a basis to disclose PHI (HHS)
Website privacy policy	Your general statement of how the site collects and uses data	Same rule: disclosure "based solely on" the policy is not permitted (HHS)
Cookie banner	A prompt to accept or reject cookies and similar tools	Banners "do not constitute a valid HIPAA authorization" (HHS)

For the banner question in detail, see why cookie banners are not HIPAA authorization.

Does a notice of privacy practices cover ad tracking?

No. A notice tells patients what you may do; it does not grant new permissions. HHS's tracking bulletin says "the Privacy Rule does not permit disclosures of PHI to a tracking technology vendor based solely on a regulated entity informing individuals in its privacy policy, notice, or terms and conditions of use that it plans to make such disclosures," and that disclosures of PHI to tracking vendors "for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS). See HIPAA marketing authorization and ad tracking.

The notice binds you the other way, too. A covered entity "may not use or disclose protected health information in a manner inconsistent with such notice" (eCFR), and your notice must say other uses happen only with written authorization (eCFR). So PHI flowing to an ad platform without authorization also runs against the authorization statement your notice must carry. For what counts as PHI on a page, see what counts as PHI on a website.

HHS model notices

HHS publishes model notices for providers and health plans, plus a Part 2 patient notice, under the heading "Revised February 2026 Model Notices of Privacy Practices (NPPs)." HHS says "Regulated entities may use these models by entering their specific information," and that the models reflect the 2024 Part 2 rule and "the Part 2-related provisions of the 2024 HIPAA Privacy Rule Final Rule" (HHS). Start there rather than from a generic template, and talk to your counsel before you publish.

How Curve Compliance helps

Your notice describes how you use PHI, so what your website actually sends should match it. Curve's free website scan lists the pixels and trackers on a page, so you can compare them with what your notice and privacy policy say.

Curve Compliance then replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent and what each platform accepted. Curve is SOC 2 Type II, signs a BAA on every plan, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.520; 45 CFR 164.502; HHS, Notice of Privacy Practices for Protected Health Information; HHS, Model Notices of Privacy Practices; HHS, Notice of Privacy Practices (for individuals); HHS, Fact Sheet 42 CFR Part 2 Final Rule; HHS, Use of Online Tracking Technologies; HHS, New Vision Dental resolution agreement; HHS, Regulatory Initiatives; Purl v. HHS opinion.

Frequently Asked Questions

What is a notice of privacy practices?

It is the notice HIPAA requires most covered entities to give patients, explaining how their PHI may be used and disclosed, their rights, and the entity's legal duties (45 CFR 164.520). A covered entity with a website about its services must post it there.

What needs to be included in a notice of privacy practices?

The required header, how PHI may be used for treatment, payment and operations with examples, other uses without authorization, the authorization statement, patient rights, the entity's duties, how to complain, a contact and an effective date (eCFR).

What must not be included in a privacy notice?

Section 164.520 is written as a list of required content. Its explicit limits: an optional statement of narrower practices may not limit uses "required by law" or certain uses to avert a serious threat, and the effective date may not be earlier than publication (eCFR).

What are three items required by the privacy rule?

For the notice, the core three are how PHI may be used and disclosed, the patient's rights, and the covered entity's legal duties (eCFR; HHS).

Do I have to post my notice of privacy practices on my website?

Yes, if your website provides information about your customer services or benefits. You must "prominently post" the notice there and make it available electronically (eCFR).

Does a notice of privacy practices allow ad tracking?

No. HHS says a notice, privacy policy or terms of use is not a basis for disclosing PHI to a tracking vendor (HHS), so tracking that would send PHI to an ad platform needs another route, such as removing the PHI first.

Do patients have to sign the notice of privacy practices?

No. Providers must make a good faith effort to get a written acknowledgment of receipt (eCFR), but HHS tells patients the law does not require them to sign it, and refusing does not stop permitted uses (HHS).

What is the new HIPAA rule in 2026?

"As of February 16, 2026," HHS says, covered entities must include information about substance use disorder records in their notice of privacy practices, and HHS revised its model notices that month (HHS). See the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. See which trackers run on your site today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.