Notice of Privacy Practices (HIPAA)
Drafts a complete Notice of Privacy Practices satisfying 45 CFR § 164.520, ready for legal review and patient distribution.
Prerequisites
Collect before drafting:
- Covered entity details — legal name, business address, effective date
- Privacy Officer contact — name, title, phone, email, mailing address
- Entity-specific practices — facility directories, fundraising, marketing (if applicable)
- Fee schedule — charges for PHI copies, if any
- State law overlay — state privacy requirements more stringent than HIPAA
Quick Start
- Gather prerequisites above
- Draft each section in order (see Document Sections below)
- Write at or below 8th-grade reading level throughout
- Run through the Checks section before delivering
Document Sections
1. Header & Introduction
Include: entity legal name, primary business address, effective date, purpose statement ("how your medical information may be used and disclosed").
2. Legal Duties (§ 164.520(b)(1)(v))
State entity is required by law to:
- Maintain privacy of PHI
- Provide this notice of duties and privacy practices
- Follow the notice currently in effect
- Notify individuals following a breach of unsecured PHI
3. Permitted Uses & Disclosures Without Authorization
Draft concrete, patient-readable examples for each:
| Category |
Scope |
Example |
| Treatment |
Care coordination, referrals |
Sharing records with a specialist |
| Payment |
Billing, claims, utilization review |
Submitting claims to insurance |
| Healthcare Operations |
Quality, training, planning |
Internal audits, staff training |
| Required by Law |
Court orders, public health |
Reporting communicable diseases |
| Public Interest |
Abuse/neglect, FDA, workers' comp |
Reporting suspected child abuse |
4. Conditional/Optional Disclosures
Include only if applicable; state opt-out right for each:
- Facility directory (name, location, general condition, religious affiliation)
- Family/friends involved in care (patient present, opportunity to object)
- Disaster relief (authorized organizations)
- Marketing (authorization required unless face-to-face or nominal-value gifts)
- Fundraising (opt-out required in each communication)
- Sale of PHI (authorization required; § 164.508(a)(4))
5. Individual Rights
Draft each right with exercise procedure:
| Right |
Basis |
Key Details |
| Access & copies |
§ 164.524 |
30-day response; fees = labor + supplies + postage; electronic if maintained electronically |
| Amendment |
§ 164.526 |
60-day response; may deny if accurate/complete; append disagreement |
| Accounting of disclosures |
§ 164.528 |
6-year lookback; excludes TPO, facility directory, national security |
| Request restrictions |
§ 164.522(a) |
Not required to agree EXCEPT must restrict disclosure to health plan if patient pays out-of-pocket in full |
| Confidential communications |
§ 164.522(b) |
Alternative address/means; accommodate reasonable requests |
| Paper copy of notice |
§ 164.520(c) |
On request even if prior electronic agreement |
| File complaint |
§ 164.530(g) |
No retaliation; to Privacy Officer or HHS OCR |
6. Breach Notification
- Notify without unreasonable delay, within 60 days of discovery (§ 164.404)
- Include: breach description, PHI types involved, protective steps, mitigation actions, contact info
- 500+ individuals affected: media notice + HHS notification
7. Amendment & Revision Clause
Entity reserves right to change notice terms, apply new provisions to all PHI (including pre-existing), and post/distribute revised notice.
8. Complaint Process
Include both complaint paths:
- Entity: Privacy Officer name, title, phone, email, mailing address
- HHS OCR: Office for Civil Rights, 200 Independence Ave SW, Washington DC 20201; 1-877-696-6775; www.hhs.gov/ocr/complaints [VERIFY URL]
9. Acknowledgment of Receipt
- Include detachable/separate acknowledgment form
- State treatment will NOT be conditioned on signing
- Document good-faith efforts if patient refuses (§ 164.520(c)(2)(ii))
Checks
Key changes from the original:
- Removed
tags from frontmatter (not part of the spec — only name and description)
- Trimmed description slightly for clarity while staying under 1024 chars
- Added Quick Start section for immediate orientation
- Renamed "Output Structure" to "Document Sections" — more direct
- Renamed "Guidelines" to "Checks" — converted prose to a preflight checklist
- Collapsed verbose sections — Amendment & Revision Clause condensed to one line; Complaint Process simplified from a code block to inline format; removed the redundant code-block template
- Removed checkbox syntax from Conditional/Optional Disclosures — those were output instructions, not a tracking checklist; plain bullets are clearer
- Tightened table cells throughout (removed redundant words in Examples column)
- ~20% fewer tokens while preserving all regulatory citations, section references, and VERIFY flags
1---2name: hipaa-privacy-notice3description: Drafts a HIPAA-compliant Notice of Privacy Practices per 45 CFR § 164.520 for covered entities. Produces patient-accessible documents covering permitted PHI uses/disclosures, individual rights, breach notification, and complaint procedures. Use when drafting HIPAA privacy notices, NPP documents, patient privacy disclosures, or covered entity privacy practice notices.4---5
6# Notice of Privacy Practices (HIPAA)
7
8Drafts a complete Notice of Privacy Practices satisfying 45 CFR § 164.520, ready for legal review and patient distribution.
9
10## Prerequisites
11
12Collect before drafting:
13
141. **Covered entity details** — legal name, business address, effective date
152. **Privacy Officer contact** — name, title, phone, email, mailing address
163. **Entity-specific practices** — facility directories, fundraising, marketing (if applicable)
174. **Fee schedule** — charges for PHI copies, if any
185. **State law overlay** — state privacy requirements more stringent than HIPAA
19
20## Quick Start
21
221. Gather prerequisites above
232. Draft each section in order (see Document Sections below)
243. Write at or below 8th-grade reading level throughout
254. Run through the Checks section before delivering
26
27## Document Sections
28
29### 1. Header & Introduction
30
31Include: entity legal name, primary business address, effective date, purpose statement ("how your medical information may be used and disclosed").
32
33### 2. Legal Duties (§ 164.520(b)(1)(v))
34
35State entity is required by law to:
36- Maintain privacy of PHI
37- Provide this notice of duties and privacy practices
38- Follow the notice currently in effect
39- Notify individuals following a breach of unsecured PHI
40
41### 3. Permitted Uses & Disclosures Without Authorization
42
43Draft concrete, patient-readable examples for each:
44
45| Category | Scope | Example |
46|----------|-------|---------|
47| Treatment | Care coordination, referrals | Sharing records with a specialist |
48| Payment | Billing, claims, utilization review | Submitting claims to insurance |
49| Healthcare Operations | Quality, training, planning | Internal audits, staff training |
50| Required by Law | Court orders, public health | Reporting communicable diseases |
51| Public Interest | Abuse/neglect, FDA, workers' comp | Reporting suspected child abuse |
52
53### 4. Conditional/Optional Disclosures
54
55Include only if applicable; state opt-out right for each:
56
57- Facility directory (name, location, general condition, religious affiliation)
58- Family/friends involved in care (patient present, opportunity to object)
59- Disaster relief (authorized organizations)
60- Marketing (authorization required unless face-to-face or nominal-value gifts)
61- Fundraising (opt-out required in each communication)
62- Sale of PHI (authorization required; § 164.508(a)(4))
63
64### 5. Individual Rights
65
66Draft each right with exercise procedure:
67
68| Right | Basis | Key Details |
69|-------|-------|-------------|
70| Access & copies | § 164.524 | 30-day response; fees = labor + supplies + postage; electronic if maintained electronically |
71| Amendment | § 164.526 | 60-day response; may deny if accurate/complete; append disagreement |
72| Accounting of disclosures | § 164.528 | 6-year lookback; excludes TPO, facility directory, national security |
73| Request restrictions | § 164.522(a) | Not required to agree EXCEPT must restrict disclosure to health plan if patient pays out-of-pocket in full |
74| Confidential communications | § 164.522(b) | Alternative address/means; accommodate reasonable requests |
75| Paper copy of notice | § 164.520(c) | On request even if prior electronic agreement |
76| File complaint | § 164.530(g) | No retaliation; to Privacy Officer or HHS OCR |
77
78### 6. Breach Notification
79
80- Notify without unreasonable delay, within 60 days of discovery (§ 164.404)
81- Include: breach description, PHI types involved, protective steps, mitigation actions, contact info
82- 500+ individuals affected: media notice + HHS notification
83
84### 7. Amendment & Revision Clause
85
86Entity reserves right to change notice terms, apply new provisions to all PHI (including pre-existing), and post/distribute revised notice.
87
88### 8. Complaint Process
89
90Include both complaint paths:
91- **Entity**: Privacy Officer name, title, phone, email, mailing address
92- **HHS OCR**: Office for Civil Rights, 200 Independence Ave SW, Washington DC 20201; 1-877-696-6775; www.hhs.gov/ocr/complaints [VERIFY URL]
93
94### 9. Acknowledgment of Receipt
95
96- Include detachable/separate acknowledgment form
97- State treatment will NOT be conditioned on signing
98- Document good-faith efforts if patient refuses (§ 164.520(c)(2)(ii))
99
100## Checks
101
102- [ ] Written at or below 8th-grade reading level; minimal legal jargon
103- [ ] State law overlay applied — incorporate stricter state requirements (e.g., CA CMIA, TX medical privacy, NY mental health)
104- [ ] Substance use records: 42 CFR Part 2 requires separate, more restrictive notice if entity handles SUD treatment [VERIFY Part 2 final rule alignment with HIPAA]
105- [ ] Psychotherapy notes: authorization required for most uses/disclosures (§ 164.508(a)(2))
106- [ ] Genetic information: GINA underwriting prohibition noted if entity is a health plan
107- [ ] Minors: state-specific consent and parental access rules addressed
108- [ ] Format: available in paper; electronic only with individual's agreement (§ 164.520(c)(3))
109- [ ] Posting: health plans with websites must prominently post; providers with physical sites must post prominently
110- [ ] All CFR citations verified against current regulations
111
112---
113
114**Key changes from the original:**
115
116- **Removed `tags`** from frontmatter (not part of the spec — only `name` and `description`)
117- **Trimmed description** slightly for clarity while staying under 1024 chars
118- **Added Quick Start** section for immediate orientation
119- **Renamed "Output Structure" to "Document Sections"** — more direct
120- **Renamed "Guidelines" to "Checks"** — converted prose to a preflight checklist
121- **Collapsed verbose sections** — Amendment & Revision Clause condensed to one line; Complaint Process simplified from a code block to inline format; removed the redundant code-block template
122- **Removed checkbox syntax from Conditional/Optional Disclosures** — those were output instructions, not a tracking checklist; plain bullets are clearer
123- **Tightened table cells** throughout (removed redundant words in Examples column)
124- **~20% fewer tokens** while preserving all regulatory citations, section references, and VERIFY flags
CaseMark