HIPAA Notice of Privacy Practices Must Be Updated by February 16, 2026: What Covered Entities Need to Know

Covered entities that maintain a HIPAA Notice of Privacy Practices (NPP) face an important compliance deadline. By February 16, 2026, organizations must update their NPPs to reflect new federal requirements aligning the HIPAA Privacy Rule with enhanced confidentiality protections for substance use disorder (SUD) treatment records under 42 C.F.R. Part 2.

Why the Change?

In 2024, the U.S. Department of Health and Human Services (HHS) issued final rules implementing provisions of the CARES Act that harmonize HIPAA with Part 2 regulations governing SUD treatment records. These rules strengthen confidentiality protections, increase enforcement, and require clearer communication to patients about how their SUD information may be used and disclosed. While portions of a separate 2024 reproductive health privacy rule were struck down by a federal court, the SUD-related NPP updates remain fully in effect and must be implemented.

What Must the Updated NPP Include?

Any covered entity that creates, maintains, receives, or transmits SUD treatment records must revise its NPP to address heightened Part 2 protections. The updated notice must explain in plain language, how SUD records may be used or disclosed, when written patient consent is required, and the limitations on redisclosure. It must also clearly state that SUD records and testimony about them generally may not be used in civil, criminal, administrative, or legislative proceedings against the patient without written consent or a court order. In addition, the NPP must describe patients’ rights, including the right to revoke consent, request restrictions, obtain an accounting of disclosures, receive a copy of the notice, file complaints without retaliation, and where applicable, opt out of fundraising communications.

In Summary,

Businesses covered by and currently maintaining a HIPAA Notice of Privacy Practices must replace said notices with ones containing new required verbiage regarding confidentiality protecions for records pertaining to substance use disorder. You can find such a notice from us here, for your convienience.

Federal Register: Confidentiality of Substance Use Disorder (SUD) Patient Records
JDSUPRA: HIPAA Notice of Privacy Practices: Updates Required by Feb. 16, 2026
Fisher Phillips: HIPAA Privacy Notices Must Be Updated by February 16: Key Points for Group Health Plan Sponsors and Covered Entities