Where the Notice of Privacy Practices Goes in Telehealth

A HIPAA-covered telehealth provider must publish its notice of privacy practices where many teams never think to look: its own website. HHS says a covered entity "must prominently post and make available its notice" on any website it maintains about its services. The notice itself is the plain-language document that tells patients how their health information may be used and shared, what rights they have over it, and who to contact with questions.

Online care also changes the rules. No clipboard sits at a front desk, so delivery, acknowledgment, and availability happen on a screen. The notice is a key part of HIPAA compliance in telehealth, and this article follows it from the website to the patient portal, explaining what HIPAA expects at each step.

What the Notice Has to Say

The HHS guidance on the notice requires it to be written in plain language and to cover:

How the practice may use and disclose protected health information about a patient
The patient's rights over that information and how to exercise them
The practice's legal duties, including a statement that the law requires it to maintain the privacy of protected health information
Whom patients can contact for more information about the practice's privacy policies
An effective date

Protected health information is narrower than everything a telehealth brand collects, and the notice describes only the protected part. This explainer on what counts as PHI shows where that line sits for a typical online practice.

HHS also publishes model notices as Word templates: one for health care providers, one for health plans, and a patient notice for federally assisted substance use disorder programs. A practice can use them by entering its own information. HHS revised the models in February 2026, for a reason covered in the last section below.

Stop 1: The Website

The posting rule applies to any website the covered entity maintains that provides information about its services. For a telehealth brand, that usually means a link in the site footer and a dedicated page holding the full notice, so a visitor can read it before starting intake. It sits on the same list as the other website requirements a brand checks before launch.

Keep the notice separate from the website privacy policy. A privacy policy explains what the company collects from site visitors and customers. In contrast, the notice of privacy practices explains how the provider uses and discloses protected health information and what rights patients have under HIPAA.

Stop 2: The Intake

For online care, the timing rule becomes specific. HHS says that for electronic service delivery, "the provider must send an electronic notice automatically and contemporaneously." The cleanest way to meet that is to show the notice inside the intake flow itself, rather than in a welcome email that may arrive after the patient has already answered clinical questions. HHS also allows a covered entity to email the notice when the patient agrees to receive it electronically.

Delivery comes with a second duty. Outside emergencies, a direct treatment provider must make a good-faith effort to obtain the patient's written acknowledgment that they received the notice. If the provider can't obtain the acknowledgment, it must document the effort. One way to ask is to include it as a step in intake, next to the telehealth consent. Counsel can confirm that the acknowledgment form meets the written standard.

Place the notice and its acknowledgment with the other patient intake forms, before the questions that collect health information. On Bask, the intake questionnaire and the patient's portal are both built in the builder, so the notice and its acknowledgment can sit as a step inside the questionnaire rather than as a separate document sent later.

Stop 3: The First Visit

A direct treatment provider must give the notice no later than the date of first service delivery. The visit format doesn't change that. In an asynchronous program, a clinician may review the questionnaire hours after the patient submits it, with no live conversation, so the notice must reach the patient before that review. For a video visit, it needs to reach the patient before the call.

Emergencies are the one exception. When care starts in an emergency, the provider provides the notice as soon as reasonably practicable and isn't required to make a good-faith effort to get a written acknowledgment.

Stop 4: The Patient Portal

The notice has to stay easy to find after the first visit. HHS expects a provider with a physical location to keep the current notice there for anyone who asks for a copy, and to post it in a clear, prominent place. An online practice has no waiting room, so the patient portal and the website page serve that function. The current version, with its effective date, should be one click from the patient's account, and the portal version should always match the website version.

When the Notice Changes

A covered entity has to promptly revise and distribute its notice whenever it makes material changes to its privacy practices. For a telehealth provider, that means replacing the website page and portal copy together and updating the effective date so no patient reads an outdated version.

The 2026 change applies to every covered entity that has to keep a notice, whether or not its own practices changed. As of February 16, 2026, health plans and covered health care providers must include information about substance use disorder (SUD) patient records, meaning the records protected under 42 U.S.C. 290dd-2(a) and 42 CFR part 2, in their notice of privacy practices. The requirement follows the 2024 Part 2 Final Rule, and HHS updated its model notices of privacy practices in February 2026 to match.

Part 2 programs that are also HIPAA covered entities may create a combined notice that meets the requirements of both the HIPAA notice and the Part 2 Privacy Notice.

FAQs

Is a Notice of Privacy Practices the Same as a Privacy Policy?

No. The Notice of Privacy Practices is a HIPAA document about protected health information and patients' rights. A website privacy policy covers the company's broader data practices for visitors and customers. Many telehealth sites need both, each with its own link.

Do Telehealth Patients Have to Sign the Notice?

The duty falls on the provider. Outside emergencies, the provider must make a good-faith effort to obtain the patient's written acknowledgment of receipt, and must document that effort if the acknowledgment isn't obtained.

What Changed in the Notice of Privacy Practices in 2026?

As of February 16, 2026, health plans and covered health care providers must include information about substance use disorder patient records protected under 42 CFR part 2. HHS revised its model notices in February 2026 to reflect the change.

Where Should a Telehealth Company Post Its Notice?

A telehealth provider that is a covered entity must prominently post the notice on any website it maintains about its services. It should also deliver the notice electronically during intake, before the first service, and keep the current version in the patient portal.

References

U.S. Department of Health and Human Services. (n.d.). Notice of privacy practices for protected health information. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-for-protected-health-information/index.html
U.S. Department of Health and Human Services. (2026). Model notices of privacy practices. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html

Theme