HIPAA Poster

HIPAA Notice of Privacy Practices Poster

Help communicate patient privacy rights and your organization's privacy practices with the HIPAA Notice of Privacy Practices Poster. This 24 x 36-inch poster provides a highly visible overview of important HIPAA privacy information for patients and individuals receiving services from covered health care providers.

The HIPAA Privacy Rule gives individuals important rights regarding their protected health information and requires most covered health care providers and health plans to provide a Notice of Privacy Practices explaining how protected health information may be used and disclosed, the individual's privacy rights, and the covered entity's legal responsibilities.

What Is a HIPAA Notice of Privacy Practices?

A Notice of Privacy Practices (NPP) explains how a HIPAA covered entity may use and disclose an individual's protected health information, the privacy rights individuals have regarding their information, and the covered entity's responsibilities for protecting that information.

The notice is intended to help patients and other individuals understand how their health information may be handled and how they can exercise their rights under the HIPAA Privacy Rule.

Who Is Required to Provide a HIPAA Notice of Privacy Practices?

Most HIPAA covered entities must develop and provide a Notice of Privacy Practices. Covered entities generally include:

• Covered health care providers
• Health plans
• Health care clearinghouses, subject to applicable exceptions

A health care provider is generally covered by HIPAA when it conducts certain covered health care transactions electronically. HIPAA requirements can vary depending on the type of entity and the health information it creates, receives, maintains, or transmits.

What Information Must a HIPAA Notice of Privacy Practices Include?

Under 45 CFR 164.520, a HIPAA Notice of Privacy Practices must contain specific information about the covered entity's privacy practices and individuals' rights.

Required information generally includes:

• How protected health information may be used and disclosed
• The individual's rights regarding protected health information
• How individuals can exercise their HIPAA privacy rights
• The covered entity's legal duties regarding protected health information
• How an individual can file a privacy complaint
• Contact information for additional privacy information
• The effective date of the notice

What Is Protected Health Information?

Protected Health Information (PHI) generally includes individually identifiable health information that is created or received by a HIPAA covered entity or business associate and is protected under the HIPAA Privacy Rule.

PHI can include information relating to an individual's health condition, health care treatment, or payment for health care when the information identifies or could reasonably identify the individual.

What Rights Do Individuals Have Under HIPAA?

The HIPAA Privacy Rule provides individuals with important rights concerning their protected health information. Depending on the circumstances, these rights can include:

• Requesting access to health records
• Requesting corrections or amendments to certain health information
• Receiving information about how health information may be used and disclosed
• Requesting certain restrictions on uses or disclosures
• Requesting confidential communications
• Receiving an accounting of certain disclosures
• Obtaining a copy of the Notice of Privacy Practices
• Filing a complaint about potential violations of HIPAA privacy rights

HIPAA Notice of Privacy Practices Posting Requirements

A covered health care provider with a direct treatment relationship must make its current Notice of Privacy Practices available at its office or facility and post the notice in a clear and prominent location where individuals seeking services can reasonably be expected to read it.

Covered entities that maintain a website providing information about their customer services or benefits must also prominently post and make their Notice of Privacy Practices available through that website.

Providing the HIPAA Notice to Patients

Posting the Notice of Privacy Practices does not eliminate other applicable distribution requirements. Covered health care providers with direct treatment relationships generally must provide the notice to individuals as required by the HIPAA Privacy Rule and make a good-faith effort to obtain written acknowledgment of receipt, except in applicable emergency treatment situations.

Individuals retain the right to receive a paper copy of the notice upon request even when the notice is also provided electronically.

2026 HIPAA Notice of Privacy Practices Updates

HIPAA Notice of Privacy Practices requirements were updated for 2026. Covered entities subject to the applicable requirements must ensure their notices reflect current HIPAA Privacy Rule provisions, including required information concerning certain substance use disorder patient records protected under federal law.

Employers, health plans, health care providers, and other regulated entities should periodically review their Notice of Privacy Practices and update it when material changes to privacy practices or applicable legal requirements occur.

HIPAA Privacy Complaints

A HIPAA Notice of Privacy Practices must explain how individuals can submit complaints regarding privacy concerns. The notice must identify a contact person or office responsible for receiving complaints and providing additional information about the covered entity's privacy practices.

Individuals may also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights regarding potential violations of HIPAA privacy rights.

HIPAA Privacy Training for Employees

Covered entities must train workforce members on the HIPAA privacy policies and procedures necessary and appropriate for employees to perform their job functions.

A HIPAA privacy poster can help reinforce employee awareness, but displaying a poster does not replace required HIPAA workforce training, privacy policies and procedures, safeguards, documentation, or other applicable HIPAA requirements.

Does a HIPAA Poster Replace the Organization's Notice of Privacy Practices?

No. A general HIPAA educational poster should not be relied upon as a substitute for a covered entity's own Notice of Privacy Practices unless the poster itself contains all information required by 45 CFR 164.520 and accurately reflects the covered entity's actual privacy practices.

A HIPAA Notice of Privacy Practices must describe the specific covered entity's permitted uses and disclosures, privacy practices, individual rights, legal duties, complaint procedures, contact information, effective date, and other information required by applicable law.

Who Is Not Generally Required to Create a HIPAA Notice of Privacy Practices?

Not every business that handles health-related information is required to create its own HIPAA Notice of Privacy Practices. For example, a business associate is not generally required by the HIPAA Privacy Rule to create its own NPP solely because it performs services for a covered entity.

Organizations should determine their status under HIPAA and the requirements that apply to their particular operations before relying on a general privacy notice.

HIPAA Notice of Privacy Practices Poster Specifications

• 24"W x 36"H
• Portrait orientation
• Printed in full color
• Laminated with high-quality laminate
• Available in English and Spanish

Workplace Policy and Compliance Resources

Labor Law Compliance Center provides employers and organizations with labor law posters, workplace policy posters, workplace safety posters, specialty postings, and compliance resources throughout the United States. Browse our Workplace Policy Posters for additional privacy, employee policy, workplace conduct, and compliance materials.