HIPAA NPP Violation: What Your Dental Practice Must Do Right Now

What HIPAA Actually Requires for Your NPP

Before you can fix an NPP problem, you need to know exactly what the requirement is. Under HIPAA's Privacy Rule, every dental practice must:

• Provide the NPP at first service: Every new patient must receive a copy of your Notice of Privacy Practices no later than the date of their first treatment appointment. This is not optional and cannot be waived.
• Make a good-faith effort to obtain written acknowledgment: You must ask each patient to sign an acknowledgment that they received the NPP. If a patient refuses to sign, you must document the refusal. The acknowledgment is required — the signature is not, but your attempt to get it must be documented.
• Post the NPP in your practice: A printed copy of your current NPP must be prominently displayed in your reception area. If you have a website, the NPP must also be available there.
• Use a current, 2026-compliant NPP: Your NPP must reflect current law. Practices still using an NPP from 2013 or earlier are out of compliance with 2021 HIPAA updates and the 2026 Security Rule changes. Language matters — OCR reviews the actual text.
• Update and redistribute when there are material changes: If your privacy practices change — new uses of patient data, new vendors, new services — you must update your NPP and redistribute it to existing patients within 60 days.

Step 1: Identify the Exact Nature of Your NPP Problem

Different NPP problems have different urgency levels and different required responses. Start here.

• You have no NPP at all: High urgency. You are in active violation of HIPAA. Do not see another patient until you have a compliant NPP ready to provide. Your first priority is getting one today — use a dental-specific template, sign it, and distribute it starting immediately.
• Your NPP is outdated (pre-2021 language): Medium urgency. Update it within 30 days. You must redistribute to existing patients with an active care relationship. New patients get the new version starting now.
• You have a current NPP but no patient acknowledgment log: Medium urgency. This is the most common gap. You cannot reconstruct past acknowledgments, but you can start the log today and document that you are doing so. Going forward, every patient signs.
• A patient complained to your practice about your NPP: High urgency. Document the complaint immediately with date, patient name, and nature of the complaint. Respond to the patient in writing within 30 days. Keep all documentation — if this escalates to OCR, your response record matters.
• You received an OCR inquiry or complaint letter: Critical urgency. Contact a HIPAA attorney before responding. OCR letters have strict deadlines — typically 30 days for an initial response. Do not ignore it. Do not respond without understanding what you're agreeing to.

Step 2: Fix the NPP Itself

If your NPP is missing or outdated, you need a replacement before you can do anything else. A compliant 2026 dental NPP must include specific language covering uses and disclosures, patient rights, your duties as a covered entity, and how patients can file complaints.

Do not use a generic healthcare NPP template. Dental practices have specific disclosure patterns (dental labs receiving X-rays and impressions, referral networks, imaging centers) that a general medical NPP does not address. OCR has flagged NPPs that are technically present but contain inaccurate descriptions of how the practice actually handles PHI.

Once you have a correct NPP: print copies for your reception desk, post one visibly in your waiting area, add it to your website (a link in the footer is sufficient), and provide it to every patient at their next visit.

Step 3: Handle the Acknowledgment Log Going Forward

The acknowledgment log is what OCR asks for second, after the NPP itself. It should show: patient name, date NPP was provided, date acknowledgment was signed or documented refusal.

You cannot backfill this log for past patients — and you should not try. Backdating compliance records is a separate violation and significantly worsens your position in any investigation. What you can do is document that you identified the gap, corrected it, and established the log as of a specific date.

For existing patients who return for care: provide the updated NPP and request a new acknowledgment at their next appointment. Document this in their chart.

Step 4: Document Your Corrective Action

The single most important thing you can do after discovering any HIPAA gap — including an NPP problem — is document your response. OCR treats a practice that identifies and corrects a problem very differently from a practice that does nothing.

Create a simple internal memo dated today that states: (1) when the problem was identified, (2) what the problem was, (3) what corrective steps were taken, and (4) what is now in place to prevent recurrence. Sign it, date it, and file it with your compliance documentation.

If OCR ever asks about this gap, your documented corrective action is your best defense. 'We identified this on [date] and took the following steps' is a much better position than 'we weren't aware.'

When to Involve a HIPAA Attorney

Most NPP problems — outdated forms, missing acknowledgment logs, no posting in waiting room — can be self-corrected without legal counsel. Fix it, document it, move forward.

You need an attorney if: you received a formal OCR complaint letter, a patient has threatened to file a complaint with OCR, you believe PHI was actually disclosed to an unauthorized party due to the NPP problem, or your practice is part of an insurance fraud or billing investigation that also involves patient records.

In those situations, your attorney-client communications are privileged. Your internal compliance memos are not.