A HIPAA Notice of Privacy Practices is the document that tells patients how you use and disclose their health information, what rights they have over it, and who to contact or complain to. 45 CFR 164.520(b)(1) sets out the required elements, and they are not discretionary. A provider with a direct treatment relationship must hand the notice over no later than the date of first service, post it where patients can read it, put it on the practice website, and make a good faith effort to get a written acknowledgment of receipt.
HIPAA Forms Pack
A plain-language Notice of Privacy Practices built on the 45 CFR 164.520 element set, the patient acknowledgment, and a release authorization — the HIPAA paperwork trio every covered practice needs.
See what's inside — $27Who is actually required to issue one
The obligation at 164.520(a)(1) attaches to covered entities. A health care provider becomes a covered entity only by transmitting health information electronically in connection with a transaction for which HHS has adopted a standard under 45 CFR Part 162, which in practice means insurance claims, eligibility verification, prior authorization, claim status, or electronic remittance advice.
A med spa that takes nothing but cash and cards, never submits a claim, and never runs an eligibility check may sit outside that definition entirely. Business associates are not required to issue their own notice either. Two cautions apply. First, one electronic transaction is enough, including a transaction a third-party biller submits on your behalf, so status can change the month you start billing for hyperhidrosis treatment or a medically indicated prescription. Second, falling outside HIPAA does not mean falling outside privacy law. State statutes such as California's Confidentiality of Medical Information Act reach licensed providers directly, consumer health data laws such as Washington's My Health My Data Act were written for entities HIPAA does not cover, and most state boards impose confidentiality duties independently. Publishing an equivalent notice is the low-friction choice, provided you do not misdescribe your own legal status inside it.
One frequent misunderstanding is worth naming. The notice is not a consent to treatment and it is not an authorization. It is a disclosure document. Bundling it into your consent form so a patient signs one line for all three weakens all three.
The required content elements under 45 CFR 164.520(b)
The table maps each element of the rule to what it means in a practice and where it should live in your paperwork.
| Requirement in 164.520(b)(1) | What it means in practice | Where it lives in your paperwork |
|---|---|---|
| (i) Prominent header | The prescribed all-caps sentence at the top of page one, not buried in body text | First line of the NPP |
| (ii)(A) Uses and disclosures for TPO | Plain-language description with at least one real example of treatment, payment, and health care operations | NPP body, section one |
| (ii)(B) Other permitted or required uses | Public health reporting, health oversight, law enforcement, judicial process, abuse reporting, and similar categories | NPP body, section two |
| (ii)(D)-(E) Authorization statements | A statement that other uses need written authorization, that marketing and sales of PHI need authorization, and that authorization may be revoked | NPP body, plus your separate 164.508 authorization form |
| (iii) Separate statements | Fundraising with an opt-out, plan sponsor and underwriting statements where applicable | NPP body, only if those activities apply to you |
| (iv) Individual rights | Restrictions, confidential communications, access and copies, amendment, accounting of disclosures, paper copy on request | NPP body, plus a patient rights request form |
| (v) Covered entity duties | Statement that you are required by law to protect PHI, to abide by the notice in effect, and to notify individuals after a breach of unsecured PHI, plus reservation of the right to change terms | NPP body |
| (vi) Complaints | How to complain to you and to the HHS Secretary, and that you will not retaliate | NPP body |
| (vii) Contact | A name or title and a telephone number | NPP body and your privacy official designation under 164.530(a) |
| (viii) Effective date | A real date, never earlier than the date the notice is printed or published | Footer of the NPP |
Two of these deserve expansion because aesthetics practices routinely mishandle them.
The individual rights block at 164.520(b)(1)(iv) must describe the right to request restrictions, and that includes the restriction a provider must accept. Under 45 CFR 164.522(a)(1)(vi), added by the HITECH Act, if a patient pays out of pocket in full for an item or service and asks you not to disclose that information to their health plan, you must agree unless the disclosure is otherwise required by law. For a practice that bills some services and not others, this is a live workflow question, not boilerplate.
The duties block at 164.520(b)(1)(v) must include the breach notification statement. Notices drafted before the 2013 Omnibus Rule often lack it, and templates copied from old sources still circulate. If your notice does not mention notifying individuals following a breach of unsecured protected health information, it is out of date by more than a decade.
The header language is not optional
164.520(b)(1)(i) requires a specific statement, prominently displayed: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
Reword it, shrink it into six-point type, or move it to page three and you have a defect an investigator can identify in seconds. HHS also publishes model Notices of Privacy Practices in several formats, including a layered design with a short summary page in front of the full text. A layered notice is permitted so long as the full required content is included, and it is a better fit for a med spa intake packet than a wall of legal text nobody reads.
How and when you must provide it
For a provider with a direct treatment relationship, which describes essentially every med spa performing injectables, lasers, or IV therapy, 45 CFR 164.520(c)(2) sets four separate obligations.
Provide the notice no later than the date of first service delivery, including service delivered electronically. In an emergency treatment situation, provide it as soon as reasonably practicable afterward. Post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service to be able to read it, and keep copies available for people to take with them. Make a good faith effort to obtain a written acknowledgment of receipt, and where you do not obtain one, document your good faith efforts and the reason it was not obtained. Separately, 164.520(c)(3)(i) requires any covered entity that maintains a website providing information about its services to make the notice available electronically through that site.
The acknowledgment is the piece most often misunderstood. It acknowledges receipt, not agreement. A patient may refuse to sign, and refusal is not a reason to withhold treatment. What the rule requires is that you tried and that you wrote down the outcome. Practically, that means a line on the intake form, a fallback note in the chart when someone declines, and a policy that tells the front desk exactly what to write.
The change most notices still have not made
Notice requirements moved twice in recent years, and only one of the moves survived. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy, published April 26, 2024, amended 164.520 and was vacated nationwide by the U.S. District Court for the Northern District of Texas in Purl v. HHS on June 18, 2025. The reproductive health attestation and notice content from that rule are no longer in force.
The court left one piece standing. The amendments to 164.520 that implement the 2024 changes to 42 CFR Part 2, governing substance use disorder treatment records, were not vacated, and carried a compliance date of February 16, 2026. If your practice is subject to Part 2, or you copied a template built for reproductive health language, your notice needs a review against what actually remains in effect rather than what a 2024-vintage template says. For a typical aesthetics practice with no Part 2 program, the practical effect is small, but a notice that still recites vacated reproductive health provisions signals a document nobody has maintained.
Beyond that, 164.520(b)(3) and (c)(1)(i)(C) require prompt revision and distribution whenever you make a material change, and you may not implement a changed practice before the effective date of the notice reflecting it. Direct treatment providers must post the revised notice and make it available on request. Keep every version. 45 CFR 164.530(j)(2) requires retaining the notices, and the acknowledgments, for six years from creation or from the date last in effect, whichever is later.
The bottom line
A HIPAA Notice of Privacy Practices has a fixed anatomy set by 45 CFR 164.520(b), from the mandatory all-caps header to the effective date, and a missing element is a visible defect. Delivery matters as much as content: first service delivery, posted in the office, published on your website, and a documented good faith effort at written acknowledgment. Check yours for the breach notification duty statement and the out-of-pocket restriction right, since older templates commonly lack both. If you are not a covered entity, you are not required to issue one, but state privacy law will still expect the practice to explain what it does with patient information.
Frequently asked questions
What must a HIPAA Notice of Privacy Practices contain?
45 CFR 164.520(b)(1) requires a prominent header in prescribed wording, a description of your uses and disclosures with at least one treatment, payment, and operations example, a list of individual rights, a statement of your legal duties including breach notification, complaint procedures, a named contact with phone number, and an effective date. Anything missing makes the notice non-compliant on its face.
Does a patient have to sign the Notice of Privacy Practices?
No. A provider with a direct treatment relationship must make a good faith effort to obtain a written acknowledgment of receipt under 45 CFR 164.520(c)(2)(ii), but the patient can decline. If they decline, you document the good faith effort and the reason it was not obtained, and you still treat them.
Does a cash-only med spa need a Notice of Privacy Practices?
Only covered entities are legally required to issue one, and a practice that never transmits a HIPAA standard electronic transaction may not be a covered entity. Most cash-pay med spas publish an equivalent privacy notice anyway, because state medical privacy laws, consumer health data laws, and partner contracts effectively demand the same disclosures.
Related templates
This guide is educational and is not legal or medical advice. Verify requirements with your own advisors and your state board before applying them in your practice.