Notice of Privacy Practices

The notice explains practices and rights

The HHS NPP guidance says most covered entities must provide a plain-language notice. It describes permitted uses and disclosures, individual rights and how to exercise them, the entity’s legal duties, complaint information, a contact, and an effective date.

The NPP should reflect the entity’s actual practices. A copied template with the wrong contact, services, or disclosure descriptions can mislead families.

Covered status comes first

The broader HHS Privacy Rule page explains the covered-entity framework. An ABA provider’s healthcare role alone does not prove that HIPAA applies. Other privacy or professional duties may require separate notices even when a HIPAA NPP is not required.

Classify each legal entity and component. A group practice, management company, school contractor, health plan, and direct-treatment provider can have different notice duties.

Direct-treatment providers have delivery duties

HHS says a covered direct-treatment provider must provide the notice no later than first service, with an emergency exception. It must make a good-faith effort to obtain written acknowledgment, document the effort and reason when acknowledgment is unavailable, post the current notice prominently at the facility, and make it available on request.

For first service delivered electronically, the provider sends the electronic notice automatically and contemporaneously in response to the first service request and makes a good-faith effort to obtain a return receipt or response. A current notice also belongs on a customer-services website.

Acknowledgment is receipt, not permission

The HHS notice page for individuals explains that signing acknowledges receipt. It does not mean the person agreed to special uses or disclosures. Refusal to sign does not stop uses or disclosures that HIPAA permits.

Therefore, acknowledgment should not become a universal service hold. Document the good-faith effort and reason according to the rule. Keep treatment consent and a HIPAA authorization in their own workflows.

The notice must stay current

Material changes to privacy practices require prompt notice revision and distribution through the rule’s applicable process. Keep the effective date, approval, version, replaced version, websites, facilities, intake packets, translations, and vendor copies synchronized.

Track which notice applied on a service date. Publishing a revised PDF while staff continue handing out an older copy creates avoidable confusion.

Part 2 changed current notice content

The HHS model-notices page says that, as of February 16, 2026, covered health plans and covered providers must include specified information about substance-use-disorder records in their NPPs. Federally assisted Part 2 programs also have an aligned patient-notice requirement.

Use the current rule and model as a starting point, then tailor the notice to the entity. A model does not decide whether the practice is a Part 2 program or replace legal review.

A fictional notice example

Cedar Loop ABA audits twelve first-service records for a covered direct-treatment component. Nine show timely notice delivery. Two have an acknowledgment, and seven document a good-faith effort plus receipt through the portal. Three records lack delivery evidence, so timely-delivery completion is 9 of 12, or 75%.

After correcting the portal trigger and replacing old intake packets, the next ten first-service records show current notice delivery in 10 of 10. Two people decline acknowledgment, and staff document that response without holding care. The measure shows delivery evidence, not whether the notice’s legal content is complete.

Questions families can ask

Ask for the current NPP at any time. Check the effective date, privacy contact, complaint routes, access and amendment instructions, confidential-communication process, typical uses and disclosures, and how the provider announces revisions.

Ask which entity the notice covers and whether other organizations involved in care have separate notices. Keep a copy with the version date. Raise any mismatch between the notice and actual practice with the privacy contact.

Practices should test notice delivery

Map every first-service route, including clinic, home, school, community, telehealth, and urgent starts. Test whether the current notice reaches the individual through each route and whether staff can document a good-faith acknowledgment effort without turning refusal into a care barrier.

Review the website, lobby posting, intake packet, portal, translations, and vendor automation after every material revision. Keep superseded versions and effective dates so the practice can identify which notice governed at a particular time.

Assign one owner to reconcile every published copy. Recheck regularly.

After a material revision, verify the effective date, required Part 2 content when applicable, website and facility copies, intake routes, translations, distribution evidence, and retained prior versions. Document every channel that still displays outdated language and assign its correction.