Home › Tools › Privacy Notice Generator

Notice of Privacy Practices Generator

Fill in your practice details and tick what applies. Get a plain-English notice that covers every element HIPAA requires, ready to print.

1. Your practice

Practice name

Address

Privacy officer (name or title)

Privacy contact phone

Privacy contact email (optional)

Website (optional)

Effective dateNot earlier than the date you publish it.

2. What applies to you

We send appointment reminders by phone, text or email

We share records through a health information exchange

We may contact patients for fundraising

We create, receive or keep substance use disorder records covered by 42 CFR Part 2

What Every Notice Must Include

Required element	What it says
Header	The exact statement in capital letters that begins "This notice describes how medical information about you may be used and disclosed"
Uses and disclosures	Treatment, payment and operations with an example of each, plus every other purpose allowed without permission
Stricter laws	Where state law or 42 CFR Part 2 gives more protection, the notice must reflect it
Uses that need permission	Marketing, sale of information, most psychotherapy notes, and anything not in the notice
Patient rights	Access, amendment, confidential communications, restrictions, an accounting of disclosures, a paper copy
Your duties	Keep information private, give the notice, notify after a breach, follow the notice, how you will share changes
Complaints	How to complain to you and to HHS, and that you will not retaliate
Contact and effective date	A name or title and phone number, and the date the notice takes effect

The February 2026 Part 2 Update

If your practice creates, receives or keeps substance use disorder treatment records covered by 42 CFR Part 2, your notice needed two new statements by February 16, 2026. Tick the Part 2 box above to add them. The 2024 reproductive health notice changes do not apply, because a federal court struck that rule down in June 2025.

How to Give the Notice to Patients

Give it to each new patient no later than the first visit, or with your first response to a telehealth patient.
Make a good faith effort to get a signed acknowledgment, and keep it for six years.
Post it in your office where patients will see it, and have copies at the front desk.
Post it on your website if you have one.
When your practices change in a material way, update the notice, repost it and offer it to patients.

Building a practice website? See our HIPAA website guide. Need a form for patients to share records with family or a lawyer? Use our HIPAA authorization form generator.

Sources: 45 CFR 164.520 (notice content and provision, current eCFR text); 45 CFR 164.524, 164.526 and 164.528 (access, amendment and accounting time frames); 42 CFR Part 2 final rule (compliance date February 16, 2026); Purl v. HHS (N.D. Tex., June 18, 2025). This tool creates a draft, not legal advice.

Frequently Asked Questions

What is a Notice of Privacy Practices?

It is the document HIPAA requires every covered health care provider to give patients. It explains how the practice may use and share health information, the patient's privacy rights, the practice's duties, and how to complain.

What changed in the Notice of Privacy Practices in 2026?

Practices that create, receive or keep substance use disorder records covered by 42 CFR Part 2 had to add new statements by February 16, 2026. They say those records will not be used against the patient in legal proceedings without consent or a court order, and give an opt-out before such records are used for fundraising. HHS updated its model notices in February 2026.

Do I still need the reproductive health statements from 2024?

No. A federal court struck down the 2024 reproductive health privacy rule in June 2025, including its notice changes. The Part 2 changes came from a different rule and still apply.

Do patients have to sign the Notice of Privacy Practices?

No. You must make a good faith effort to get a written acknowledgment that the patient received it, usually a signature on an intake form. If the patient refuses, note the attempt. You still treat the patient.

Where do I have to post my Notice of Privacy Practices?

Post it in a clear and prominent place in your office, keep copies for anyone who asks, and post it on your website if you have one that gives information about your services.

Hassan Raza Awan, Founder of LegitMedBilling & IT Solutions

Written by Hassan Raza Awan

Founder — LegitMedBilling & IT Solutions

Hassan has 4+ years of hands-on U.S. medical billing experience — working claims, denials, credentialing, and payer follow-up for practices across the United States. Every guide he publishes is written from real remittances and payer behavior, not theory.

Need Help With HIPAA Paperwork?

We set up compliant intake, billing and records workflows for U.S. practices. Start with a free one-week audit.

Get Free Practice Audit Medical Billing Services