---
title: "Notice of privacy practices review"
url: "https://ailawframework.com/precedents/health-and-medical-law/us-npp-review"
type: "precedent"
site: "AI Law Framework"
id: "a32-us-npp-review"
area_id: "A32"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A32-T1-R8", "A32-T20261018-15"]
law_stated_as_at: "2026-10-22"
---

# Notice of privacy practices review

> Review list for the required elements of a HIPAA notice of privacy practices under 45 CFR 164.520(b). It checks a draft. It is not the notice that is distributed.

Canonical page: https://ailawframework.com/precedents/health-and-medical-law/us-npp-review  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Health & Medical Law](https://ailawframework.com/precedents/health-and-medical-law.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 2 authorities it cites, for United States.

## When to use it

Use when a lawyer is checking a draft notice against the required elements in 45 CFR 164.520. Do not use it as the notice given to patients, and do not use it to decide who must provide a notice.

## Used for these tasks

- [Map health-privacy duties across the records systems](https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems.md)
- [Respond to a patient's request for access to their health records](https://ailawframework.com/practice/health-and-medical-law/respond-to-a-patient-s-request-for-access-to-their-health-records.md)

## How AI may be used

Yellow: the lawyer confirms each element against the entity's actual practices before the notice is used.

**AI may:**

- Set out the header sentence that 45 CFR 164.520(b)(1)(i) requires, as a check, not as a finished notice.
- List the required descriptions in 164.520(b)(1) and leave each example blank for the lawyer.
- Point to the reproductive-health prohibition in 164.502(a)(5)(iii) that the notice must describe.

**AI must not:**

- Do not issue or distribute a notice of privacy practices.
- Do not invent an example of treatment, payment, or health care operations.
- Do not restate 45 CFR 164.508, 164.509, 164.522, 164.524, 164.526, 164.528, or 164.530. Those sections were not opened.
- Do not state a delivery deadline. Section 164.520(c) was not used for timing.

**The lawyer checks:**

- Match each description to what this entity actually does.
- Write any example. This list does not supply one.
- Read 164.520(c) before stating when or how the notice is given.
- Read 164.520(a)(3) before relying on any exception other than the inmate exception in (a)(4).

## Authorities

- [45 CFR § 164.520](https://www.law.cornell.edu/cfr/text/45/164.520)
- [45 CFR § 164.502](https://www.law.cornell.edu/cfr/text/45/164.502)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/health-and-medical-law/us-npp-review and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*