A statement informing individuals they can file complaints with the entity or the Secretary of HHS without fear of retaliation.
A statement that information disclosed by a covered entity could potentially be re-disclosed by the recipient and no longer protected by HIPAA. Structure of the Document Title: Notice of Privacy Practices. Effective Date: The date the notice is effective. Introduction: Purpose of the notice.
A description of how the entity may use and disclose protected health information (PHI) for treatment, payment, and health care operations.
A statement that the entity is required by law to maintain the privacy of PHI and provide notice of its legal duties.
Notice of Privacy Practices for Protected Health Information - HHS.gov
Clear information on the individual's rights, including the right to inspect, copy, amend, or request restrictions on their PHI.
Based on your request, here is the proper content covering the Notice of Privacy Practices (NPP) requirement for covered entities, often referenced in 2026 updates, particularly regarding the handling of sensitive patient information.
Specific language clarifying that SUD records (Part 2 records) require written authorization for disclosure, even for treatment or payment purposes in many cases.