Recorded template baseline: September 18, 2024. Historical bundle release: July 9, 2026. Actual agreement and notice dates depend on execution or adoption. This resource does not establish operational compliance.
HIPAA Notice of Privacy Practices Template
Customization required. This template is provided for policy operations and counsel review. Replace every
NEXQ-reviewed value, verify every factual statement, and confirm applicability before publication. The template is not legal advice and does not create an attorney-client relationship.
Recorded template baseline: September 18, 2024
Last updated: September 30, 2026
Owner: NEXQ privacy, security, and legal
operations
Applies to: NEXQ websites, web applications, protected
workspace surfaces, mobile app surfaces, APIs, secure healthcare and
healthtech workflow demonstrations, security and post-quantum readiness
planning, diagnostics-workflow support concepts, oncology workflow
research, cardiovascular longevity research, research collaboration,
support, and related services
This is a template aid for covered entities. It is not a complete substitute for a HIPAA Notice of Privacy Practices drafted by healthcare counsel.
Required elements to customize
- Covered entity name and contact information.
- HIPAA Privacy Officer and complaint contact.
- Effective date.
- Uses/disclosures for treatment, payment, and healthcare operations.
- Uses/disclosures requiring authorization.
- Uses/disclosures with opportunity to agree or object.
- Uses/disclosures permitted or required by law.
- Patient rights: access, amendment, accounting, restrictions, confidential communications, paper copy, breach notification.
- Covered entity duties: maintain privacy, provide notice, follow notice terms, notify affected individuals following breach.
- Complaint procedure and no retaliation statement.
- State-specific rights and stricter health privacy rules.
- Substance-use, mental health, reproductive health, HIV/STI, genetic, minor, and sensitive categories where applicable.
Software-specific supplement
The covered entity may use software vendors, cloud providers, business associates, patient portals, telehealth, remote monitoring, AI-assisted documentation, and interoperability tools. The NPP should align with actual operations and BAAs.
Applicable 2026 notice updates
The applicable 2024 Part 2 requirements and surviving HIPAA NPP amendments had a February 16, 2026 compliance date. Before adopting a notice:
- Describe stricter Part 2 limits on uses/disclosures where applicable, including the restrictions on records or testimony in proceedings against a patient. A qualifying court order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling it.
- Include the required fundraising choice if the covered entity intends to use Part 2 records for fundraising.
- If operating a Part 2 program, address its separate patient-notice, consent, complaint, and delivery obligations under 42 CFR 2.22.
- Complete the actual entity’s rights, complaint contacts, distribution procedure and effective date. Do not equate this checklist with an adopted patient notice or claim that the deferred new Part 2 accounting requirement is already effective.
Read 45 CFR 164.520 and 42 CFR 2.22 together with HHS’s notice of the Purl vacatur; the vacated reproductive-health provisions are not current federal notice requirements.