Foundational pillar / check privacy-practices-notice-link
Notice of Privacy Practices on the website
Checks for a link to a Notice of Privacy Practices, which HIPAA requires a covered entity to post prominently on a website about its services.
By Shimon Carroll, Founder, SEO for AI Agents · Last updated
What this check measures
Links whose text or address mention "Notice of Privacy Practices", "privacy practices", "HIPAA", or "NPP". A text mention without a link is reported but does not pass.
Why it matters
Under 45 CFR 164.520(c)(3)(i), a covered entity that maintains a website providing information about its customer services or benefits must prominently post its notice and make it available electronically through the site. This applies to HIPAA covered entities; it is not a universal "HIPAA footer" rule, and HHS permits electronic communication with patients when reasonable safeguards are in place.
How we score it
A review prompt, not a legal verdict. Runs only on medical practice audits. When the cue is missing the finding is medium severity at medium confidence, which lowers the foundational pillar by about 2.4 points. A pass is informational and never scores. Each finding names who should review it, quotes what we saw on the page, and cites the primary source. Where the page shows a US address we name the inferred state; otherwise the wording is state-agnostic.
Confidence-flag rules
MEDIUM: the link text and address are read exactly, but we cannot tell from the page whether the practice is a HIPAA covered entity (for example, some direct primary care practices are not). The finding says so and asks your privacy officer to confirm.
Common mistakes
- Linking only a general website privacy policy and treating it as the notice.
- Posting the notice as a scanned image that is hard to read or find.
- Assuming every practice is a covered entity, or that none is, without checking.
How to fix it
If you are a covered entity, post your Notice of Privacy Practices as an accessible page or PDF and link it prominently, usually in the footer of every page. If you are not, confirm that with your privacy officer and disregard the finding.
Primary sources
- 45 CFR 164.520, Notice of privacy practices for protected health information
Electronic Code of Federal Regulations
- HHS, May covered entities provide HIPAA notices of privacy practices electronically?
U.S. Department of Health and Human Services
Changelog
- · New. This rule used to live only in the vertical configuration and never ran. It is now a registered review check with a cited primary source, framed as a prompt to review with a professional rather than a pass or fail legal verdict.