Do I need a patient's signature?

A patient's signature is not required for most Notices; however, covered entities often request an acknowledgement of receipt to document distribution. Keep signed or electronic acknowledgements in the record to demonstrate compliance.

Can the Notice be delivered electronically?

Yes. Electronic delivery is allowed if the patient consents and can access the electronic format (15 U.S.C. §7001). For consumer-facing delivery, obtain a consumer disclosure and confirm access per ESIGN and applicable state law.

How often must the Notice be updated?

Update the Notice whenever privacy practices materially change and make the revised Notice available promptly. Maintain version history and effective dates; retain prior versions for six years per HIPAA retention guidance (45 CFR §164.530(j)).

What if state law is stricter than HIPAA?

Follow the law that affords greater protection to individuals. Where state statutes impose stronger privacy requirements, incorporate those provisions into the Notice and operational policies.

Are business associates required to provide the Notice?

Business associates generally do not issue the Notice directly, but contracts must require BAAs and appropriate patient-facing disclosures when the business associate's activities affect PHI distribution.

What should I do when a patient requests access?

Follow HIPAA access procedures: verify identity, respond within required timeframes, provide copies or summary, and document the response. If access is denied, provide a written denial with the right to review and complain to OCR.

Electronic Signature
Templates
Insurance
Notice of Privacy Practices

Notice of Privacy Practices

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

What the Notice of Privacy Practices Is

The Notice of Privacy Practices explains how a covered entity may use and disclose an individual's protected health information (PHI), and it describes patients' rights regarding that information under the HIPAA Privacy Rule (45 CFR §164.520). It summarizes permitted uses and disclosures, required safeguards, complaint procedures, and the right to access, amend, and request restrictions on PHI. Covered entities and qualified health plans must make the notice available to patients at first service and upon request, and must post it where services are provided and on any website offering direct patient services.

Why a Clear Notice Matters

A clear Notice of Privacy Practices helps patients understand rights over their PHI, supports regulatory compliance with HIPAA (45 CFR §164.520), and documents an entity's privacy policies. It reduces complaints, streamlines requests for access or amendment, and provides legal transparency.

Who Issues and Uses the Notice

Covered entities and health plans use this Notice to meet HIPAA disclosure obligations and to inform patients how their PHI is handled.

Hospitals and clinics: Issue at first service and include in patient intake materials.
Health plans: Send to enrollees and make available online and upon request.
Business associates: Provide to covered entity patients when required by contract or law.

Core elements every Notice should include

A professional Notice of Privacy Practices clearly states permitted uses, patient rights, contact information, complaint procedures, effective date, and how PHI is protected.

Uses and Disclosures

Describe routine uses (treatment, payment, operations), incidental disclosures, and any disclosure categories requiring authorization; be specific about third-party sharing and research or marketing exceptions under HIPAA.

Patient Rights

Explain right to access and obtain copies, request amendment, accounting of disclosures, right to request restrictions, and right to receive confidential communications.

Privacy Practices Contact

Provide a named privacy official, phone number, mailing address, and email contact for submitting complaints or requests related to PHI access or privacy concerns.

Complaint Process

Describe how to file a complaint internally and note the right to file with HHS OCR; include timeframe expectations for acknowledgements and responses.

Effective Date

State the notice effective date and advise patients that the entity will update the Notice; explain how revised notices will be posted and distributed.

Special Situations

Identify situations like fundraising, public health reporting, or health plan communications; disclose any state-law stronger protections that affect PHI handling.

Legal and security foundations to reference

HIPAA Basis: 45 CFR §164.520 (Privacy Rule)

State Privacy Laws: Varies by state; may be stronger

BAA Requirement: Business Associate Agreement may be required

Consent Exceptions: Required for most psychotherapy notes

Access Rights: Right to inspect and obtain copies

Amendments: Right to request changes to PHI

Step-by-step: preparing and issuing the Notice

Follow these steps to create, approve, and distribute a compliant Notice of Privacy Practices to patients and staff.

01

Draft content: Compile accurate descriptions of uses, rights, contacts.
02

Legal review: Have counsel review for HIPAA/state compliance.
03

Approve and date: Set effective date and document approval.
04

Distribute: Post, provide at first visit, and publish online.

Where to file, send, or post the Notice

Identify recipients and posting locations for the Notice, and define how to record delivery or patient acknowledgement.

Patients: Give at first service and on request.
Website: Post full Notice on patient-facing website.
Intake materials: Include a paper copy in registration packets.
OCR complaints: Provide HHS OCR contact info for complaints.

Technical considerations for electronic distribution

Digital delivery requires PDF/HTML formats, secure hosting, ADA accessibility, clear download options, and visible posting on the provider website.

Formats: PDF and HTML recommended.
Accessibility: WCAG 2.0 AA compliance advised.
Retention: Maintain copy in records per policy.

Digital workflow settings to capture acknowledgements

Configure digital workflows to capture acknowledgements, timestamp delivery, and store signed receipts in the patient record.

Field	Configuration
Delivery Method	Email link, portal, paper
Acknowledgement	Signed form or electronic consent log
Storage	Attach PDF to EHR or document repository
Access Control	Role-based access, audit trail enabled

Penalties and compliance risks to avoid

OCR Enforcement: Civil penalties and corrective action

Patient Complaints: Increased complaints and investigations

Reputational Harm: Public loss of trust and credibility

State Liability: State-level enforcement or private actions

Operational Burden: Increased audits and remediation costs

Contract Risk: Business associate breaches can create liability

Common mistakes when preparing the Notice

Using overly technical or legalistic language that patients cannot understand and that increases phone inquiries and confusion.
Failing to update the effective date or version history when privacy practices change, which can create compliance gaps during audits.
Omitting a named contact or providing incorrect contact information, preventing patients from filing complaints or submitting access requests.
Distributing inconsistent copies (printed version differs from website version), which can trigger regulatory scrutiny and patient disputes.

Timelines and timing obligations to keep in mind

Key timing rules focus on initial delivery, posting online, and retention; ensure processes assign responsibilities and document each timing event.

Initial Delivery:

Provide at first service and upon request (45 CFR §164.520).

Revisions:

Post updated Notice promptly after revision and provide to new patients.

Patient Requests:

Acknowledge access or amendment requests per HIPAA timeframes.

Website Posting:

Keep online copy current and accessible to patients.

Record Retention:

Maintain Notice versions and acknowledgements for six years (45 CFR §164.530(j)).

eSignature vendor comparison for distributing and signing the Notice

Feature-level comparison of common eSignature vendors for distributing and signing a Notice of Privacy Practices; signNow is listed first per platform data.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

FAQs — common questions about the Notice of Privacy Practices

Answers to frequently asked questions about delivery, signatures, updates, and interactions between federal and state rules for the Notice of Privacy Practices.

Need help? Contact support

Do I need a patient's signature?
A patient's signature is not required for most Notices; however, covered entities often request an acknowledgement of receipt to document distribution. Keep signed or electronic acknowledgements in the record to demonstrate compliance.
Can the Notice be delivered electronically?
Yes. Electronic delivery is allowed if the patient consents and can access the electronic format (15 U.S.C. §7001). For consumer-facing delivery, obtain a consumer disclosure and confirm access per ESIGN and applicable state law.
How often must the Notice be updated?
Update the Notice whenever privacy practices materially change and make the revised Notice available promptly. Maintain version history and effective dates; retain prior versions for six years per HIPAA retention guidance (45 CFR §164.530(j)).
What if state law is stricter than HIPAA?
Follow the law that affords greater protection to individuals. Where state statutes impose stronger privacy requirements, incorporate those provisions into the Notice and operational policies.
Are business associates required to provide the Notice?
Business associates generally do not issue the Notice directly, but contracts must require BAAs and appropriate patient-facing disclosures when the business associate's activities affect PHI distribution.
What should I do when a patient requests access?
Follow HIPAA access procedures: verify identity, respond within required timeframes, provide copies or summary, and document the response. If access is denied, provide a written denial with the right to review and complain to OCR.

Explore Templates

Applicant Tracking Form Personnel Action Form Notification of Workers’ Compensation Injury/Illness Action Plan Worksheet

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now