Website NPP posting

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The trigger depends on the website's function

Current 45 CFR 164.520 applies to a covered entity website that provides information about customer services or benefits. Inventory public sites, subdomains, portals, location pages, acquisitions, and branded service sites. Record which notice and covered entity each page represents.

Determine scope before publishing one universal link. A health plan, provider, affiliated entity, joint arrangement, or acquired brand may use a different notice. Map domains, page owners, covered entities, service descriptions, audiences, and the correct current notice. Preserve the analysis for sites judged outside the trigger.

Include microsites, campaign pages, mobile web, benefits portals, and vendor-hosted customer information. A corporate home page may link to several notices; labels should let a visitor choose correctly.

Prominent access needs testing

Use a descriptive link, stable URL, readable HTML or accessible download, and mobile-friendly route. Check search, navigation, language access, assistive technology, file metadata, caching, and the version shown after a revision. Avoid hiding the only link in a legal footer few people can find.

Test from the home and service paths without authentication. Check keyboard navigation, screen readers, zoom, mobile, download name, headings, and link purpose. Verify search engines and internal search do not prioritize an obsolete public PDF. Use redirects carefully so historical citations remain distinguishable from the current notice.

Release revisions across every property

Maintain one controlled source, approved derivative formats, effective date, deployment plan, and property checklist. Update links and content together, purge caches, confirm content-delivery networks, and remove or clearly archive obsolete public versions. Validate vendor-hosted pages and acquired sites.

Website posting remains separate from individual delivery, physical posting, and paper-copy rights. A public link supports access but does not establish that a particular person received the notice.

Example with web properties

Six covered web properties are in scope. Five link the current notice; one acquired clinic site links an expired PDF. Current-version coverage is 5 of 6 properties.

After correction, test the acquired site's navigation, direct URL, cache, and mobile view before moving it into the completed numerator. Search for the obsolete PDF and redirect or archive it under the approved version policy.

Website-posting checklist

• Inventory all customer-service and benefits web properties.
• Map each property to the correct covered entity and notice.
• Provide a prominent descriptive route without unnecessary login.
• Test accessibility, mobile, search, downloads, caching, and redirects.
• Deploy revisions through a versioned release checklist.
• Keep individual delivery, paper copies, and physical posting separate.
• Retain property, test, release, and remediation evidence.

Owner controls

HHS model-notice guidance reiterates prominent website availability. Maintain a property inventory, canonical file, redirect tests, automated link checks, effective-date release plan, and owner. Preserve historical versions separately from the public current notice.

Monitor current-version coverage, broken links, accessibility defects, obsolete public files, and unowned properties. Combine automated checks with human navigation testing after redesigns, acquisitions, notice revisions, and domain changes.

Establish publication ownership across privacy, legal, content, engineering, and acquired brands. The privacy owner approves substance and effective date, while the site owner confirms deployment and the technical owner monitors availability. Keep a release manifest with domain, route, entity, version, checksum or other reproducible identifier, deployment time, cache status, and tester. Review redirects before deleting a file used by mailed or printed links.

Audit real discovery paths. Ask a tester unfamiliar with the site to find the NPP from home, services, benefits, location, contact, and search pages. Test common misspellings and browser search results for obsolete copies. Inspect analytics only as a usability signal, not as proof of prominence. During an outage, provide an alternate current route and restore the canonical link promptly. Preserve screenshots and accessibility results without relying on them as the only evidence.

Treat third-party and localized experiences as part of the inventory when they represent the covered entity. Check appointment, intake, benefit, and patient-facing vendor pages; alternate languages; mobile layouts; and downloadable files. Confirm that authentication, cookie banners, geolocation, or consent prompts do not block ordinary access to the notice. When a vendor hosts the file, retain the entity's own approval and monitoring evidence. Contract terms can assign technical work, but the operational register still needs an owner who verifies the public route after each release.

Record the browser, device class, route, language, and observed version in each test so a later reviewer can reproduce and resolve the finding.