Practice website privacy policy vs privacy notice

Look at the footer of most practice websites and you will find a link called “Privacy”. Sometimes it opens a generic website privacy policy. Sometimes it opens the practice’s HIPAA Notice of Privacy Practices. Sometimes it opens a page that tries to be both and does neither job well.

These are two different documents. One is required by the HIPAA Privacy Rule and describes how the practice uses and discloses patients’ health information. The other describes what the website itself collects from visitors: form entries, cookies, analytics, ad tags. This guide explains the difference, what the federal rules say about each, and how to place both on your site. Every rule cited here links to its source at the end.

This is general information for practice owners, not legal advice, and nothing here is a template we vouch for legally. Your notice and your privacy policy should be written or reviewed by your privacy officer or a healthcare attorney who knows your practice and your state.

Two documents, two jobs

The Notice of Privacy Practices (often shortened to NPP) is a HIPAA document. HHS describes it as a plain language notice of how a covered entity may use and disclose protected health information, the patient’s rights over that information, and the covered entity’s legal duties. It covers the practice as a whole: the chart, billing, referrals, the phone, the front desk. It is the same notice you hand to new patients at the office.

A website privacy policy covers the website. It tells visitors what the site collects when they browse it or fill in a form, what that data is used for, which outside services receive it, and what choices they have. It is the document that has to match what your contact form, chat widget, analytics and ad tags actually do.

Neither one replaces the other. A website privacy policy does not contain the elements HIPAA requires of a notice, and an NPP says nothing about cookies or ad pixels. Most practice sites need both, clearly labelled.

Does your practice need a Notice of Privacy Practices?

The notice requirement applies to HIPAA covered entities. For a practice, that means a health care provider that conducts certain standard transactions electronically, such as sending claims to a health plan. CMS has a short tool for checking whether you are a covered entity, linked below. A cash-only practice that never bills a health plan electronically may not be a covered entity, but that is a question to settle with your attorney, not by assumption. Even a practice outside HIPAA is still subject to the FTC Act when it describes what it does with health information, which we come back to below.

What HIPAA says about your NPP and your website

The notice rule is at 45 CFR 164.520. For a practice website, the key line is in paragraph (c)(3)(i): a covered entity that maintains a website providing information about its customer services or benefits “must prominently post its notice on the web site and make the notice available electronically through the web site.” HHS repeats this on its guidance page and on its model notice page.

The same section sets out the other ways a provider with a direct treatment relationship has to make the notice available. In short:

Give the notice no later than the date of first service delivery, including service delivered electronically.
Except in an emergency, make a good faith effort to get a written acknowledgment that the patient received it, and document the effort if you cannot.
Keep copies at the office for patients to take, and post it in a clear and prominent location there.
If first service is delivered electronically, send an electronic notice automatically and at the same time as the patient’s first request for service.
Email the notice only if the patient agrees to electronic notice. A patient who received it electronically can still ask for a paper copy.
Make the notice available to anyone who asks for it, patient or not.

When the notice changes, a provider must make the revised version available on request from its effective date and update the copies posted and handed out at the office. The website copy is part of that: if the office has the new notice and the site still links to the old one, the two do not match.

The rule also requires the practice to keep copies of every notice it has issued, along with the acknowledgments or the record of good faith efforts. Under 45 CFR 164.530(j), that documentation is kept for six years from the date it was created or last in effect, whichever is later. Keeping a dated copy of each version you posted on the site makes this easier.

What the notice itself has to contain

Paragraph (b) of 164.520 lists the required elements. The notice must be in plain language and include:

The required headerThe statement “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.” as a header or otherwise prominently displayed.
Uses and disclosuresA description, with at least one example, of the uses and disclosures the practice may make for treatment, payment and health care operations, plus the other purposes the rule permits.
Patient rightsThe rights to request restrictions, to confidential communications, to inspect and copy, to amend, to an accounting of disclosures and to a paper copy of the notice, with a short description of how to exercise each.
The practice’s dutiesThat the practice is required by law to maintain the privacy of protected health information, to provide the notice, to notify affected individuals after a breach of unsecured protected health information, and to follow the notice currently in effect.
ComplaintsThat patients may complain to the practice and to the Secretary of HHS, how to complain to the practice, and that they will not be retaliated against for complaining.
Contact and effective dateThe name or title and phone number of a person or office to contact, and the date the notice takes effect.

That list is a summary. The regulation itself has more detail in each paragraph, and your attorney will work from the text, not from this page.

Check the date on your posted notice

HHS’s model notice page states that as of February 16, 2026, HIPAA covered entities are required to include information about substance use disorder patient records covered by 42 CFR Part 2 in their notice of privacy practices. HHS published revised model notices in February 2026 that reflect those changes, including a model notice for health care providers. HHS says regulated entities may use the models by entering their specific information.

That makes the effective date on your website copy worth a look. If the PDF linked from your footer was uploaded years ago, ask whoever handles your privacy program whether it is the current version, and replace the file on the site when the office copy changes.

What a website privacy policy should cover

There is no single federal rule that lists the sections of a practice’s website privacy policy, and state laws vary, so the list below is a practical outline rather than a legal standard. What federal law does require is that whatever the policy says is true. The FTC Act prohibits unfair or deceptive practices, and the FTC’s guidance on health information says its obligations apply to HIPAA covered entities as well as to businesses outside HIPAA. The same guidance tells businesses to make representations “consistent with your practices”, not to bury key facts in a privacy policy, and not to make false or misleading claims that they are “HIPAA Compliant,” “HIPAA Secure,” or “HIPAA Certified.”

With that in mind, a policy for a practice website usually needs to answer:

What the site collects. Form fields, chat messages, booking requests, call tracking numbers, cookies, analytics and any advertising tags.
Why. Replying to a request, booking, measuring which pages are used, running ads.
Who receives it. The outside services involved: hosting, the form or booking tool, email, analytics, ad platforms. Name the categories at least, and keep the list current.
How long it is kept and how a visitor can ask about it or have it removed.
Choices. How to decline non-essential cookies where you offer that, and how to contact the practice instead of using a form.
A pointer to the NPP. A sentence explaining that the practice’s handling of patient health information is described in its Notice of Privacy Practices, with a link.
Changes and contact. The date of the current version and who to ask.

Our own privacy policy follows a similar outline. Because our site is for practice owners rather than patients, it also asks visitors not to send patient information through our form.

Tracking tags are where the two documents meet

The hardest part of a website privacy policy is usually the tracking section, because it has to describe tags that a marketing vendor may have added years ago. HHS guidance on online tracking technologies says tracking on user-authenticated pages, such as a patient portal or telehealth platform, generally has access to protected health information. A federal court vacated part of that guidance on June 20, 2024, specifically the part about certain unauthenticated pages; the court’s order is noted at the top of the HHS page. We cover what that means in more detail in our guide to tracking pixels on practice websites.

For the privacy policy, the practical point is simpler: list what is actually on the site. Run a tag audit, compare it with the policy, and fix whichever one is wrong. If a tag should not be there, remove it rather than writing around it.

Where to put both on the site

The rule says “prominently post” without naming a spot on the page. The placements below are what we recommend; they are our suggestions, not a regulatory requirement.

Two separate footer links on every page, labelled “Notice of Privacy Practices” and “Website Privacy Policy”, so nobody has to guess which is which.
A link to the NPP on the new patient page, the booking page and the patient portal login page, where patients are most likely to look for it.
A short line under each form that says what the form is for and links to the website privacy policy. See our guide to website contact forms and HIPAA for what forms should and should not collect.
The NPP as an HTML page, or as a PDF that works with a screen reader, so every patient can read it. Our guide to website accessibility for medical practices covers documents as well as pages.

Illustration. A line under an appointment request form might read: “This form is for requesting an appointment. Please do not include details about your symptoms or medical history. See our Website Privacy Policy for how we handle what you send, and our Notice of Privacy Practices for how we protect your health information as a patient.” The exact wording should come from your privacy officer and match what the form actually does.

A quick review you can do this week

Open your footerIs there a link to the Notice of Privacy Practices, and a separate one to the website privacy policy? Do both open?
Compare the NPP versionsIs the notice on the site the same version as the one handed out at the front desk, with the same effective date?
List your tags and toolsWrite down every form tool, chat widget, analytics tag and ad tag on the site.
Read the policy against that listAnything on the site that the policy does not mention, or anything the policy promises that the site does not do, goes to your privacy officer.
Check the claimsSearch the site for “HIPAA compliant”, “HIPAA secure” and similar phrases, and have counsel review any you find.

If you are planning a new site, put these pages in the plan from the start. Our medical practice website checklist and our medical website design page describe how we approach forms, tracking and the pages around them.

Questions practice owners ask

Can our website privacy policy include the Notice of Privacy Practices?

The notice has its own required elements, header and effective date, and patients need to be able to find it as the notice. Keeping it as a separate, clearly labelled document is the simplest way to make sure it is prominently posted and recognisable. Whether a combined document would work for your practice is a question for your attorney.

Do we need an acknowledgment from people who read the notice on our website?

The written acknowledgment requirement in 164.520(c)(2)(ii) is tied to giving the notice at first service delivery to a patient, not to posting it on the website. Posting on the site is a separate requirement. If you deliver first service electronically, such as by telehealth, the rule has its own provisions for electronic notice; read paragraph (c)(3) with your attorney.

Can we use the HHS model notice?

HHS publishes model notices, including a February 2026 version for health care providers, and says entities may use them by entering their specific information. Your attorney may still want to adjust it for how your practice actually operates.

Should our website privacy policy say we are HIPAA compliant?

The FTC’s guidance on health information warns against false or misleading claims of being “HIPAA Compliant,” “HIPAA Secure,” or “HIPAA Certified.” Describe what you actually do with the data instead, and let counsel decide what can be said about HIPAA.

Who should write these documents?

Your privacy officer or a healthcare attorney. A web team can tell them what the site collects and where it goes, and can post the pages and link them in the right places. That is the part we help with; we do not write legal documents for practices.

Terms of use and medical advice notices are separate documents from this one. See our guide to medical website disclaimers, terms of use and emergency notices.

Sources

More in Practice websites, privacy and tracking

Website privacy policy vs Notice of Privacy Practices: what a practice website needs