If you've ever stared at a HIPAA certification exam question that reads "the blank describes how PHI may be used," you're not alone. Thousands of healthcare workers encounter this exact phrasing every year — in quizzes, compliance modules, and workforce training assessments. The answer is the Notice of Privacy Practices (NPP). But knowing the answer and understanding what it actually means for your organization are two very different things.

I've spent years reviewing how covered entities handle their Notice of Privacy Practices, and the gap between "having one" and "using it correctly" is where OCR penalties live. Let's break this down so it sticks — not just for the exam, but for real-world compliance.

The Notice of Privacy Practices Describes How PHI May Be Used

Under the HIPAA Privacy Rule, every covered entity — hospitals, clinics, health plans, healthcare clearinghouses — must provide individuals with a Notice of Privacy Practices. This document describes how protected health information (PHI) may be used and disclosed by the organization.

The NPP isn't optional decoration for your lobby wall. It's a legal requirement codified at 45 CFR § 164.520. It must clearly explain the ways a covered entity can use or share a patient's PHI, the individual's rights regarding their own health information, and the entity's legal duties to protect that information.

So when an exam question states "the blank describes how PHI may be used," the answer is always the Notice of Privacy Practices.

What Exactly Goes Into an NPP?

I've reviewed hundreds of these documents. The good ones are clear, specific, and written at a reading level actual patients can understand. The bad ones are twelve pages of legal jargon that no one reads. Here's what yours must include:

  • Uses and disclosures for treatment, payment, and healthcare operations (TPO): The core permitted uses of PHI without patient authorization.
  • Uses and disclosures that require written authorization: Marketing, sale of PHI, and psychotherapy notes fall here.
  • Individual rights: The right to access records, request amendments, receive an accounting of disclosures, and request restrictions.
  • The covered entity's legal duties: A statement that the organization is required by law to maintain the privacy of PHI and to notify individuals following a breach.
  • Contact information: Who to call with complaints, including the HHS Office for Civil Rights (OCR).

If any of these elements are missing from your NPP, you have a compliance gap that OCR can and will act on.

The $2.175 Million Mistake: When Your NPP Isn't Enough

Having an NPP on file doesn't protect you if your organization ignores it in practice. In 2019, Sentara Hospitals agreed to a $2.175 million settlement with OCR after mailing PHI — billing statements containing patient diagnoses — to wrong addresses affecting 577 individuals. Part of the investigation revealed failures in breach notification practices, which are supposed to be outlined in the NPP itself.

The NPP promises patients that their information will be protected. When your operations don't match those promises, OCR treats it as a systemic compliance failure — not a one-off mistake. You can read more about OCR enforcement actions on the HHS enforcement outcomes page.

Why the NPP Matters Beyond the Exam Question

Here's what I tell every client: the Notice of Privacy Practices is the contract between your organization and every patient you serve. It's the document that says, "Here's what we will and won't do with your most sensitive information." When your staff doesn't understand it, they can't honor it.

That's why workforce training isn't a checkbox exercise. Every employee who touches PHI — from the front desk to the billing department to the IT team — needs to understand what the NPP commits your organization to doing. Our HIPAA training catalog covers NPP requirements alongside practical scenarios your team will actually face.

Who Has to Provide a Notice of Privacy Practices?

Every covered entity. That means:

  • Healthcare providers who transmit health information electronically in connection with standard transactions (claims, referrals, eligibility inquiries).
  • Health plans — including employer-sponsored group health plans, insurers, and HMOs.
  • Healthcare clearinghouses that process nonstandard health information into standard formats.

Business associates, on the other hand, do not provide NPPs directly to patients. But they are contractually bound through Business Associate Agreements to follow the covered entity's privacy practices. If your business associate violates the terms your NPP lays out, you're both on the hook.

When Must You Distribute the NPP?

Timing matters. For healthcare providers with a direct treatment relationship, the NPP must be provided no later than the first date of service delivery. You also must make a good-faith effort to obtain a written acknowledgment that the patient received it.

Health plans must distribute the NPP at enrollment and again within 60 days of any material revision. If you change how PHI may be used — say you begin sharing data with a new analytics vendor — your NPP must be updated, and patients must be notified.

I've seen organizations go years without updating their NPP after adding telehealth platforms, patient portals, or new business associate relationships. Each of those changes potentially alters how PHI is used and disclosed. If it's not reflected in your NPP, you're out of compliance.

The Most Overlooked Requirement: Making It Available on Your Website

If your covered entity has a website, you must prominently post your current NPP on it. Not buried in a footer link labeled "Legal." Not in a PDF that takes three clicks to find. HHS expects it to be accessible. You can review the full regulatory text on the HHS Privacy Practices guidance page.

Quick Answer: What Describes How PHI May Be Used?

The Notice of Privacy Practices (NPP) describes how PHI may be used and disclosed by a covered entity. It is required under the HIPAA Privacy Rule at 45 CFR § 164.520. The NPP must be provided to every individual and must explain permitted uses of PHI, individual rights, and the organization's legal obligations to protect health information.

How to Make Your NPP Actually Work

A compliant NPP isn't just a document — it's an operational commitment. Here's what I recommend to every organization I consult with:

  • Review your NPP annually. Compare it against your current data practices, vendor relationships, and technology stack. If anything has changed, revise it.
  • Train your workforce on what the NPP says. If your receptionist can't explain the basics of how your organization uses PHI, the NPP is failing its purpose. Explore role-specific courses in our HIPAA training catalog to close that gap.
  • Document your distribution process. Keep records showing when patients received the NPP and whether they signed the acknowledgment. OCR will ask for this during an investigation.
  • Write it in plain language. HHS encourages NPPs that patients can actually understand. A document written at a 12th-grade reading level defeats the purpose of transparency.

The Bottom Line on PHI Use and the NPP

Every time someone searches "the blank describes how PHI may be used," they're usually studying for a compliance exam or trying to understand their obligations under HIPAA. Either way, the answer points to the same foundational document: the Notice of Privacy Practices.

But don't stop at memorizing the answer. Your organization's NPP is a living document. It shapes patient trust, guides your workforce's daily decisions, and serves as Exhibit A when OCR comes knocking. Get it right, keep it current, and make sure every person on your team understands what it promises.

Because when PHI is mishandled, "we have an NPP" is only a defense if your operations actually match what it says.