The HIPAA Notice of Privacy Practices (NPP) is one of the most universally received and universally ignored documents in American healthcare. Every covered entity — hospitals, doctor's offices, pharmacies, health plans — is required to provide it. Most people sign the acknowledgment without reading it.
Understanding what's actually in that notice matters, because it describes how your most sensitive personal information — your health records — can be used and disclosed, and it identifies rights you have that can be exercised at any time.
What the HIPAA NPP Is (and Isn't)
The most important thing to understand: the NPP is a notice, not a consent form.
Signing the acknowledgment does not mean you've consented to your information being shared. It means you've been informed that the notice exists. Even if you refuse to sign, your provider can still treat you — they simply note in their records that you declined to acknowledge receipt.
HIPAA requires covered entities to give you the notice; it does not require your permission to engage in the activities described in it.
What Providers Can Share Without Your Authorization
HIPAA's central framework distinguishes between disclosures that require patient authorization and disclosures that don't. The following can happen without your authorization:
Treatment, Payment, and Healthcare Operations (TPO)
These are the three pillars of permitted disclosures:
-
Treatment: Your doctor can share your records with a specialist they're referring you to. The hospital can share your chart with the consulting cardiologist. The pharmacy can receive your prescription. All of this is permitted without separate consent.
-
Payment: Your provider can share the information necessary to bill your insurance company. The insurer can share relevant information with your employer's plan administrator (for self-insured plans).
-
Healthcare Operations: Quality improvement, audits, training, administrative activities, and accreditation. A hospital can share de-identified records for quality reviews without patient consent.
Public Health and Safety
Providers can disclose health information (without your authorization) to:
- Public health authorities reporting communicable diseases (mandatory disease reporting)
- The FDA for safety monitoring of drugs and medical devices
- To prevent or control disease, injury, or disability
- In some cases, to law enforcement (with specific requirements)
- To coroners, medical examiners, and funeral directors
- To avert a serious and imminent threat to someone's health or safety
Other Permitted Disclosures
- Workers' compensation programs, as required by law
- Judicial and administrative proceedings (in response to court orders or subpoenas)
- Certain research (with IRB oversight and limitations)
- For national security and intelligence activities
What Requires Your Authorization
For uses and disclosures outside the permitted categories, your provider needs your written authorization. This includes:
- Sharing your records with your employer for employment purposes (note: occupational health records are different)
- Use of your information for marketing purposes (with limited exceptions)
- Sale of your health information
- Sharing psychotherapy notes (these receive extra protection under HIPAA)
- Sharing information with family members or friends (absent an emergency) — unless you've given permission or the provider uses professional judgment that you'd agree
- Most research that involves your individually identifiable information
Authorization is specific: An authorization must identify what information is being shared, with whom, for what purpose, and when it expires. You can revoke an authorization at any time (except where the provider has already acted in reliance on it).
Your Rights Under HIPAA — Most Patients Don't Know These
HIPAA grants you several rights regarding your health information. These are exercisable at any time and are not dependent on anything in the NPP:
1. Right to Access Your Records
You have the right to inspect and receive a copy of your medical records held by a covered entity. The provider must:
- Respond within 30 days (extendable by one 30-day extension)
- Provide records in the format you request (including electronic) if readily producible
- Charge only reasonable, cost-based fees (not excessive copy fees)
They may deny access in limited circumstances (e.g., psychotherapy notes, information compiled for legal proceedings), but denials are subject to review.
2. Right to Request Amendments
If you believe your health record contains incorrect or incomplete information, you can request an amendment. The provider can deny the amendment request, but must give reasons and allow you to submit a statement of disagreement that becomes part of your record.
3. Right to an Accounting of Disclosures
You can request a list of disclosures your provider has made of your health information over the past 6 years. The accounting doesn't include disclosures for TPO purposes (those are too routine to track) but includes most other disclosures — to law enforcement, public health authorities, etc.
4. Right to Request Restrictions
You can request that your provider restrict how it uses or discloses your information — for example, asking that certain conditions not be shared with specific family members. The provider doesn't have to agree to most restrictions.
Important exception: If you pay out-of-pocket in full for a service, you can require the provider not to share information about that service with your health plan. This right is absolute — the provider must honor it.
5. Right to Request Confidential Communications
You can request that your provider communicate with you in a specific way or at a specific location. For example, you can ask that appointment reminders go to your work phone rather than your home phone, or that bills be sent to a PO box. Providers must accommodate reasonable requests.
6. Right to a Paper Copy of the Notice
Even if you received it electronically or years ago, you can request a current copy of the NPP from any covered entity at any time.
How to File a HIPAA Complaint If Your Rights Are Violated
If you believe a covered entity has violated your privacy rights or misused your health information:
-
Complain to the covered entity first: Many organizations have a Privacy Officer designated in the NPP. A written complaint to them may resolve the issue.
-
File a complaint with the HHS Office for Civil Rights (OCR): Submit online at hhs.gov/hipaa or by mail. You must file within 180 days of when you knew (or should have known) of the violation.
-
File with your state: Many states have stronger health privacy laws than HIPAA. Your state attorney general's office may have jurisdiction.
Important: HIPAA does not create a private right of action — you cannot personally sue a provider for a HIPAA violation. Enforcement is through OCR, which can impose civil penalties ranging from $100 to $50,000+ per violation category, with caps depending on culpability.
Some states (like California with the Confidentiality of Medical Information Act) do allow private lawsuits for health privacy violations.
A Note on Who HIPAA Covers — and Doesn't
HIPAA covers "covered entities" — health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically. It also covers their "business associates."
HIPAA does not directly cover:
- Life insurance companies
- Employers (though they have separate privacy obligations)
- Workers' compensation carriers in most contexts
- Many wellness apps and consumer health apps
- Schools and their health records (covered by FERPA instead)
When you share health information with apps like fitness trackers or symptom checkers, you're likely not protected by HIPAA at all — their privacy practices are governed only by their own terms of service and state law.
Got a HIPAA notice, explanation of benefits, or healthcare document you need help understanding? Upload it to PaperLens for a plain-English explanation of what it says and what your rights are. Scan your document →