The HIPAA Privacy Rule generally requires covered entities (health plans, health care providers and health care clearinghouses) to provide individuals with a Notice of Privacy Practices (or Privacy Notice) to ensure they understand how their protected health information (PHI) may be used and disclosed, as well as their rights with respect to PHI.
A final rule issued by the U.S. Department of Health and Human Services (HHS) in April 2024 requires covered entities to update their Privacy Notices if they receive or maintain patient records regarding substance use disorder (SUD) treatment provided by a federally assisted treatment program (i.e., a “Part 2 program”). The deadline for updating Privacy Notices for the additional privacy protections for Part 2 program records is Feb. 16, 2026.
Self-insured health plans must maintain and provide their own Privacy Notice at enrollment time, when there is a material change and upon request. Fully insured health plans that do not have access to PHI (other than enrollment and summary health information) are not required to maintain or provide a Privacy Notice. Fully insured health plans with access to PHI must maintain a Privacy Notice and provide it upon request.
Employers that maintain Privacy Notices for their health plans should update them with the changes to SUD treatment records by Feb. 16, 2026. Employers with self-insured health plans should also distribute their updated Privacy Notices by this deadline. It is uncertain if HHS will update its model privacy notices to incorporate the new requirements before the compliance deadline.
Contact us to see how you could minimize risk:
- |
- |