HIPAA Notice of Privacy Practices Updates for SUD Records: What Employers Need to Know by February 16, 2026
Updates to HIPAA Notice of Privacy Practices Due February 16th
The U.S. Department of Health and Human Services previously issued final rules enhancing privacy protections for substance use disorder (“SUD”) records and programs subject to 42 CFR Part 2 (“Part 2”). Under the final rules, HIPAA covered entities that receive or transmit Part 2 or SUD data are required to update their Notice of Privacy Practices (“NPP”) to address the additional protections.
The updated NPP must include the following:
- An explanation of the heightened confidentiality and stricter limits for use and disclosure of SUD information.
- Confirmation that SUD records cannot be disclosed in legal proceedings without written consent or court order.
- Information related to the redisclosure of SUD information and limitations around the use of SUD data for fundraising purposes.
HIPAA covered entities and covered employer health plans who create, receive, maintain, or transmit SUD data must ensure compliance with the updated NPP requirements by February 16, 2026. Covered employer health plans that do not operate a Part 2 program may still be subject to the requirements if they receive SUD data for care coordination, payment, or other health care operations. Due to this, it is important that covered entities review the data typically received to ensure they are prepared to comply.
