Does a patient have to sign the notice of privacy practices?

No. You must make a good-faith effort to get a written acknowledgment and document the attempt if they decline, but care cannot be conditioned on signing.

Do we have to give the notice at every visit?

No. Providers give it at the first service and make it available on request and when it materially changes.

Is there an official template?

HHS publishes model notices for providers and health plans that you can customise.

The notice of privacy practices

Every covered entity must give patients a notice of privacy practices (NPP) explaining how it uses their health information and what rights they have (45 CFR 164.520). HHS publishes model notices you can adapt.

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on October 22, 2026.

The short answer

A provider with a direct treatment relationship must give the notice no later than the first service, make a good-faith effort to get the patient’s written acknowledgment, post it in a clear and prominent place at the practice, and post it on its website if it has one.

What the notice must contain

The required headerA statement, in prominent type, that the notice describes how medical information may be used and disclosed and how the patient can get access to it.
Uses and disclosuresDescriptions, with at least one example, of uses for treatment, payment, and operations, and of other permitted purposes.
When authorization is requiredIncluding that other uses need written authorization, which can be revoked.
The patient’s rightsAccess, amendment, accounting, restrictions, confidential communications, and a paper copy of the notice.
The covered entity’s dutiesIncluding the duty to notify affected individuals after a breach of unsecured PHI.
How to complainTo the covered entity and to HHS, with a statement that there will be no retaliation.
Contact and effective dateA person or office to contact for more information, and the date the notice took effect.

Paraphrased from 45 CFR 164.520(b). HHS has amended this section over time; read the current eCFR text before revising your notice.

Distribution and posting

First visit: give the notice no later than the date of first service delivery; in an emergency, as soon as practicable afterward.
Acknowledgment: make a good-faith effort to obtain written acknowledgment of receipt, and document it if the patient will not sign. The patient does not have to sign for you to provide care.
Posting: post the notice at the service delivery site where patients can read it, and on your website if you maintain one.
Changes: when you make a material change, revise the notice and make it available.

Model notices

HHS publishes model notices of privacy practices (opens in a new tab) for providers and health plans, in several layouts and languages. They are a starting point: fill in your practice’s details and check them against your actual practices.

Common questions

Does a patient have to sign the notice of privacy practices?: No. You must make a good-faith effort to get a written acknowledgment and document the attempt if they decline, but care cannot be conditioned on signing.
Do we have to give the notice at every visit?: No. Providers give it at the first service and make it available on request and when it materially changes.
Is there an official template?: HHS publishes model notices for providers and health plans that you can customise.

Sources

45 CFR § 164.520 — Notice of privacy practices (opens in a new tab) — Electronic Code of Federal Regulations
Model Notices of Privacy Practices (opens in a new tab) — HHS Office for Civil Rights
Summary of the HIPAA Privacy Rule (opens in a new tab) — HHS Office for Civil Rights

Questions about this page

Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.

Get in touch