HIPAA Notice of Privacy Practices Updates Required by February 16

Recent changes to the HIPAA Privacy Rule require covered entities, including group health plans, to update their Notice of Privacy Practices (NPP) by February 16, 2026. Generally, the changes are designed to align HIPAA and a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR Part 2 (referred to as Part 2). The Part 2 final regulations provide heightened confidentiality protections for sensitive SUD treatment information. We discussed these updates in our prior article on the substance use disorder records final rule.

As background, a Part 2 program is a federally assisted program that primarily serves to provide diagnosis, treatment, or referral for treatment of an SUD. Although group health plans are not Part 2 programs, plans and their vendors can receive Part 2-protected records through claims appeals, medical management and care coordination processes, and behavioral health programs, among other situations. The Part 2-protected information received may be subject to specific restrictions regarding its further use and disclosure.

Self-insured group health plans must maintain and distribute an NPP that explains how the plan may use and disclose protected health information (PHI), participant rights, and the plan’s responsibilities. (Most fully insured plans are hands-off with respect to PHI (i.e., minimum involvement with PHI such as basic functions like enrollment and disenrollment), and the NPP obligation is fulfilled by the carrier. However, fully insured plans that are hands-on with respect to PHI (i.e., more active management of PHI) will have greater obligations; clients can download our publication HIPAA Privacy and Security for Group Health Plans: A Guide for Employers, from the Help Center, for further details.)

As a result, plans are required to revise their NPP, regardless of whether they normally receive Part 2-protected records. Among other items, the updated notice should explain that additional legal protections may apply to certain SUD records, the participant’s rights, and the plan’s legal duties.

Accordingly, employers should work with their legal counsel and vendors to determine where Part-2 protected information may be disclosed. Counsel can then assist with carefully tailoring the NPP to incorporate the protections for SUD information under the Part 2 final rule within the HIPAA framework. The updated NPP should be distributed to participants and new enrollees. Employers should also review their HIPAA policies and procedures and training materials to ensure these materials also appropriately address the handling of SUD information.

Our compliance team will monitor for any new HHS guidance to assist employers with the NPP revisions and will provide updates in Compliance Corner.