Notice of Privacy Practices
PLACEHOLDER — this one is not optional. If you are a HIPAA covered entity, you are required to have a Notice of Privacy Practices and to make it available to patients. HHS publishes model notices you can adapt, but have counsel confirm the final version and that it matches how you actually handle records.
What this notice covers
How health information about you may be used and disclosed, and how you can get access to it.
How I use and disclose your information
Treatment, payment, and healthcare operations, plus any required disclosures.
Your rights
Access, amendment, an accounting of disclosures, restriction requests, confidential communications, and a paper copy of this notice.
Website analytics and cookies
Separate from the clinical notice: say what the site itself collects. Keep this honest and current as you add tools.
Complaints and contact
Who to contact here, and the right to complain to HHS without retaliation.