The Notice of Privacy Practices: What Yours Must Say (and the Mistake in Most Therapists' NPPs)

Somewhere in your intake packet is a document you copied from your first group practice, who copied it from a colleague, who — if you trace the wake back far enough — copied it from a dentist working off a 2004 template. It's called the Notice of Privacy Practices, every client signs it without reading it, and if we're honest, you haven't read it lately either. It rides along in the packet like a barnacle: attached, ignored, and slowly becoming a problem.

Here's why it deserves twenty minutes of your attention. The NPP is the one HIPAA document every client must actually receive — not a policy in a drawer, but a paper (or PDF) placed in their hands. And it's one of three documents that get mashed together in therapy intake packets, each with a different job. Your informed consent explains the treatment relationship: what therapy is, its risks, the limits of confidentiality, how to reach you in a crisis. Your financial agreement covers fees, cancellation policy, and who pays. The NPP does neither of those things. It explains how protected health information moves through your practice — who sees it, when, and what rights your client has over it. Three documents, three jobs. When they blur into one signature line, none of them does its job well, and the NPP is usually the one that sinks.

What the notice must say, section by section

The content isn't up to you. Federal regulation (45 CFR 164.520) prescribes it, starting with the header — an exact sentence that must appear prominently, in these words:

If your notice doesn't open with that sentence, it fails on line one. After the header, here's the required cargo, annotated for a therapy practice:

• Uses and disclosures for treatment, payment, and operations — with examples. Generic examples from a medical template read strangely in a therapy office, so translate them: sending a claim to your client's insurer is "payment." Coordinating with their psychiatrist is "treatment." Discussing the case with your clinical supervisor or having a billing service prepare statements is "operations." The examples must be real enough that a client can picture them.
• Uses that require the client's written authorization. The regulation specifically calls out psychotherapy notes, marketing, and the sale of health information as disclosures that need a signed authorization first. For therapists, the psychotherapy-notes line matters most — more on that below.
• The client's rights. To see and get a copy of their record, to request amendments, to receive an accounting of disclosures, to request restrictions on how you use their information, to ask for confidential communications (the client who says "call my cell, never the house line" is exercising a federal right), to be notified if their information is breached, and to get a paper copy of the notice itself on request.
• Your duties. That you're required by law to protect their information, to give them this notice, and to abide by its current terms.
• How to complain. To your practice, and to the Secretary of Health and Human Services (the Office for Civil Rights) — with an explicit statement that you will not retaliate against anyone who files a complaint.
• A contact person and an effective date. In a solo practice the contact is you, which feels silly to write down and is required anyway. The effective date tells a client which version of your practices applies.

Notice what's not on the list: anything about consenting to treatment, agreeing to fees, or promising to show up on time. The NPP is a disclosure document, full stop.

The signature mistake almost everyone makes

Here's the error sitting in most therapists' intake packets: a line that says something like "I consent to the uses and disclosures described in the Notice of Privacy Practices." That sentence misunderstands what the signature is for. The client isn't consenting to anything. HIPAA already permits treatment, payment, and operations uses without consent. What the rule requires is that you make a good-faith effort to obtain a written acknowledgment of receipt — a signature that says "I got a copy," nothing more.

The distinction has teeth in both directions. Because it's not consent, a client can't "revoke" it, and you can't refuse to treat someone who won't sign. And because the standard is good-faith effort rather than success, a client's refusal doesn't put you out of compliance — as long as you document that you offered the notice and they declined. A one-line note in the chart ("NPP provided 7/19/2026; client declined to sign acknowledgment") satisfies the rule. No note, no proof — and in a records dispute years later, the paper trail is your ballast.

Where should the signature live? Anywhere durable: a signed page in the intake packet, or an e-signature captured during digital intake. What matters is that the acknowledgment is written, dated, and retrievable — and that the language above it says receipt, not consent.

What the dentist's template never mentions

A generic medical NPP can be technically compliant and still fit a therapy practice like a borrowed raincoat. Four things a mental-health notice should handle that the hand-me-down template won't:

• Psychotherapy notes get their own lock. Your private process notes — kept separate from the medical record — can't be disclosed for treatment, payment, or operations the way progress notes can. Nearly every disclosure of them requires the client's specific authorization, and your NPP should say so plainly. If the difference between the two note types is fuzzy, read psychotherapy notes vs. progress notes first — the distinction shapes what your notice promises.
• State law may go further than HIPAA — and stricter state law wins. Many states protect mental-health and substance-use records more tightly than federal law does. Your NPP should acknowledge that where state law is more protective, you follow state law. What that means concretely varies by state; this is a paragraph worth running past an attorney licensed where you practice.
• Minors and guardian access. Whether a parent can see a teenage client's record depends heavily on state law — ages of consent to treatment, minor-consent exceptions, and carve-outs differ enormously from state to state. Don't copy another state's language here. Say what your state allows, in words a worried parent and a wary sixteen-year-old can both understand, and verify the specifics locally before you print it.
• Telehealth and messaging. If sessions happen over video and scheduling happens over a portal, your notice is a sensible place to state how those channels are secured and what you use them for. It's not a distinct federal NPP requirement — it's an honest description of how information actually moves through a modern practice, which is the whole spirit of the document.

Delivery, posting, and keeping it current

• First service delivery. The notice goes to the client no later than the first session (in an emergency, as soon as reasonably practicable afterward). Practically, it belongs in the intake paperwork completed before you ever sit down — see our intake process guide for where it fits in the sequence.
• Post it in the office where clients can see it, with copies available to take.
• Post it on your website — if you maintain a site with information about your services, the notice must be prominently available there too.
• Revise it when your practices materially change — new uses of information, a new AI documentation tool, a change in how you handle records. Update the notice and the effective date before the new practice begins, repost it, and make the current version available to clients. Whether you must re-distribute it to every existing client depends on the change; the conservative move for a small practice is to hand the new version out at the next visit. An NPP with a 2019 effective date describing a practice that now runs on telehealth and e-signatures isn't a safe harbor. It's an anchor dragging bottom.

One piece of genuinely good news: you don't have to draft this from a blank page. HHS and the Office of the National Coordinator publish model NPPs — plain-language, professionally designed, free — intended for providers to customize. Start there, then make the mental-health adaptations above. And remember the notice only describes your practices; you still have to run a practice worth describing. Our HIPAA-compliant documentation guide covers that side of the ledger.

A quick scope note: HIPAA formally applies to covered entities — and a therapist who bills insurance electronically, or uses a billing service that does, is one. If you're a cash-only practice that has never conducted an electronic covered transaction, you may fall outside HIPAA's letter, but clients expect these protections, some state laws impose similar duties, and the moment you file one claim you're covered. Most practices should simply act covered.

This is also where the paperwork can quietly automate itself. Practice Harbor's digital intake delivers your NPP to new clients alongside the rest of the packet, captures the e-signature acknowledgment of receipt, and records the refusal if a client declines — so the good-faith-effort trail HIPAA asks for builds itself while you're doing the part of intake that actually requires a clinician.

This article is educational, not legal advice. Privacy law — especially around minors and state mental-health confidentiality — varies by state and changes over time. For your practice's specific obligations, consult a healthcare attorney licensed in your state.