Client Alert: HIPAA Covered Entities that Create, Maintain, or Receive Part 2 SUD Records Must Update Their Notice of Privacy Practices by February 16, 2026

Overview of Required NPP Changes:

42 C.F.R. Part 2 applies to patient records created by, received or acquired by any federally assisted program that provides diagnosis, treatment or referral for treatment of a substance abuse disorder (SUD) (“Part 2 Records”). On April 26, 2024, the Department of Health and Human Services published a Final Rule (the “April 2024 Rule”) to require covered entities that create, maintain, or receive Part 2 Records to modify their HIPAA Notice of Privacy Practices (NPP).  These updates must be made by February 16, 2026.  Specifically, covered entities that create, maintain, or receive Part 2 Records must update their NPP as follows:

1. Other Applicable Law – In describing how “other applicable law” restricts the use or disclosure of PHI for purposes of treatment, payment and health care operations, include a description of how 42 C.F.R. Part 2 limits uses or disclosures of PHI for such purposes.
2. No Use or Disclosure for Civil, Criminal, Administrative, or Legislative Proceedings Without Authorization – Include a separate statement that Part 2 Records, or testimony relaying the content of such records, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent from the individual or a court order after notice and opportunity to be heard is provided to the individual or the holder of the record. The NPP must also state that a court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.
3. Opportunity to Opt-Out of Fundraising Communications – To the extent the covered entity intends to use or disclose Part 2 Records for fundraising purposes, state that an individual is required to be provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.

Next Steps:

1. If you are a HIPAA covered entity that creates, maintains, or receives Part 2 Records, update your NPP to be consistent with the requirements of the April 2024 Rule (to the extent you have not already done so).
2. If you update your NPP, make sure each patient whose first service delivery date is after the date on which you update your NPP receives and acknowledges receipt of the updated NPP and otherwise make the revised NPP available to patients as required by HIPAA.