Additional Requirements for the Notice of Privacy Practices Under the proposed regulations, a covered entity must include a description of certain types of uses and disclosures of PHI that require an authorization in its notice of privacy practices (i.e., psychotherapy notes, marketing, and sale of PHI).