An NPP diligence check is the 42 CFR 2.3(b) review of a provider's Patient Notice or HIPAA Notice of Privacy Practices when it is available online or at the physical location. The notice can supply evidence about Part 2-covered services and privacy practices. It remains one part of the required diligence sequence rather than a standalone status determination.
Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.
Current rule checkpoint
Live 42 CFR 2.3(b)(1)(iv) includes viewing a provider's Patient Notice or HIPAA Notice of Privacy Practices when it is available online or at the physical location. The notice check belongs to the complete pre-demand or preplacement reasonable-diligence sequence and must be tied to the correct entity, site, version, evidence, and timing.
Locate the current notice
42 CFR 2.3 names both the Patient Notice and HIPAA NPP. Record the provider, notice title, location, effective or revision date, retrieval date, version, relevant Part 2 language, and reviewer.
Read scope and entity references carefully
Check whether the notice applies to the specific entity, unit, site, service, or organized arrangement under review. A general privacy page may cover several operations. Preserve the full document and surrounding applicability language.
Unavailability needs evidence
Document searches, site navigation, physical-location review, broken links, and staff-facing escalation. Continue the federal locator, state database, and provider-site actions. Qualified counsel resolves conflicting or incomplete results.
Locate the correct notice
Resolve the provider's legal and trade names, domain, service location, parent and affiliated entities, and the destination for the demand or placement. Search public privacy, patient rights, forms, admissions, footer, legal, portal, and location pages for a Patient Notice or HIPAA Notice of Privacy Practices. At a physical location, review notices available to the public without entering restricted clinical areas.
Record when no notice is found and exactly where and how the search was performed.
Verify entity, scope, and version
Read the notice's covered entity or program names, effective or revision date, locations, services, organized health care arrangement, affiliated entities, contact information, and Part 2 references. Distinguish a current notice for the target site from a corporate template, another affiliate's notice, an expired version, or a general website privacy policy.
Preserve conflicts between the notice and other public information. A notice can guide diligence without conclusively deciding Part 2 coverage.
Preserve reproducible evidence
Save URL, page title, access date and time, PDF or rendered copy, effective date, entity language, relevant sections, location observation, reviewer, and interpretation. Note inaccessible links, portal login, missing dates, unreadable scans, or unavailable copies. Avoid photographing people, patient lists, appointment boards, or other identifying information during a location check.
Use a second-person review when entity scope or Part 2 language is ambiguous.
Interpret the notice in context
Identify whether it states that the provider offers SUD services, maintains Part 2 records, follows Part 2, or has service-specific privacy duties. Also record silence, narrow scope, or limiting language. Compare those facts with SAMHSA and state listings, public service descriptions, site evidence, and provider identity.
Qualified counsel makes the applicability decision. A missing Part 2 reference does not prove that protected records are absent.
Complete and refresh the sequence
Finish the notice review and all other listed actions within a reasonable period and no more than 60 days before demand or on-site placement. Refresh after a delay, notice revision, site change, acquisition, rebranding, or new evidence. Link the saved version and decision to the exact investigative step.
Audit entity match, availability evidence, version, interpretation, patient-data avoidance, timing, and remaining diligence checks.
Reconcile translations and multiple notices
Compare translated, web, PDF, portal, posted, and intake versions for entity, effective date, location, and Part 2 language. Record which version was publicly available at the target site and time. A translation lag or outdated lobby copy can create a conflict that needs counsel review rather than selective reliance on the preferred text.
When several affiliated entities share a notice, verify whether the target provider and location are actually included. Preserve the scope language supporting that match.
Example and controls
Seven notice reviews are due. Five preserve the current document, scope, relevant language, and cross-source decision; two capture only a web excerpt. Completeness is 5 of 7 reviews.
Notice-diligence checklist
- resolve the target provider, site, domain, affiliates, and receiving entity;
- search public online and physical-location channels for the applicable notice;
- verify entity scope, services, locations, version, and Part 2 language;
- preserve the exact notice, search evidence, unavailability, conflicts, and review;
- reconcile the result with federal, state, website, and location checks; and
- refresh within timing limits and link it to the demand or placement.
The notice check is useful when its identity, version, limits, and relationship to other public evidence are explicit.
Related terms
Sources
Take the next step with clarity
Whether you are finding care, growing as a clinician, or building a stronger ABA practice, Finni brings the people, tools, and support together to help you move forward.
Start or grow your ABA practice with Finni