Health care providers and other HIPAA covered entities must update their Notice of Privacy Practices (“NPP”) by February 16, 2026 to incorporate new requirements. The new requirements stem from changes to the Privacy Rule designed to align HIPAA with the regulations governing substance use disorder (“SUD”) treatment records under 42 C.F.R. Part 2 (“Part 2”).

On April 26, 2024, the U.S. Department of Health and Human Services (“HHS”) issued a final rule that created new privacy protections for reproductive health information and integrated certain Part 2 requirements into the HIPAA Privacy Rule. Although subsequent court decisions vacated those portions of the final rule related to reproductive health privacy, HHS has confirmed that the provisions concerning SUD treatment records and related NPP modifications are undisturbed and remain in effect. Accordingly, covered entities must update their NPPs by February 16, 2026 to comply with the following requirements:

1. Explanation of Rights and Limitations Pertaining to SUD Treatment Records
   If the covered entity maintains SUD treatment records from Part 2 programs, the NPP must provide the patient with adequate notice about how the covered entity may use and disclose the patient’s SUD treatment records. Part 2 imposes stricter limitations than HIPAA on use and disclosure of SUD treatment records, even for treatment, payment, and health care operations purposes. Covered entities that receive or maintain SUD treatment records from Part 2 programs must clearly communicate these restrictions.

2. Prohibition on Use or Disclosure of SUD Treatment Records in Legal Proceedings
   The NPP must inform the patient that SUD treatment records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient, unless authorized by the patient’s written consent or the order of a court after the patient has been provided notice of the court order and an opportunity to be heard.

3. Fundraising Communications
   If the covered entity intends to use or disclose SUD treatment records for fundraising for the benefit of the covered entity, the covered entity must first give the patient a clear and conspicuous opportunity to opt out of receiving any fundraising communications.

4. Notice of Potential Redisclosure
   The NPP must contain a statement that puts the patient on notice of the potential for protected health information disclosed by the covered entity to be redisclosed by the recipient and no longer protected under the Privacy Rule.

For information regarding these requirements, please contact a member of the Koley Jessen Health Law practice group.

_{This content is made available for educational purposes only and to give you general information and a general understanding of the law, not to provide specific legal advice. By using this content, you understand there is no attorney-client relationship between you and the publisher. The content should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.}