A valid Notice of Privacy Practices must:

Detail specifically all activities that are considered a use or disclosure.

Describe in plain language what is meant by treatment, payment, and health care operations (TPO)

Inform the individual that protected health information (PHI) may only be used for valid medical research.

Inform the individual that this version of the Notice will always cover them, regardless of subsequent changes.

State the expiration date of the Notice.