When one bank is organized under a holding company with no other affiliates, am I correct in that the new privacy notice need only be sent from the bank (the "financial institution") and not the holding company?

I understand that to be correct. We are doing the same thing & listing our holding company as an affiliate.

Under this scenario, then should we place the name of both the bank and the bank holding company under the Name of the Institution or Group of Affiliated Institutions Providing the Notice at the top of the first page and second page?

Then also, under the sections in the notice where it advises of sharing information with an affiliate, does the term "affiliate" include the holding company and should be therefore denoted appropriately in the body of the notices? I noted under the general definitions in Regulation P that Affiliate means any company that controls, is controlled by, or is under common control with another company. This would seem to preclude using form builder number 4.