February 2026 Deadline Approaches for HIPAA Notice of Privacy Practices Updates Under Revised Part 2 Rules

In 2024, the U.S. Department of Health and Human Services (HHS) issued final rules requiring sweeping updates to the privacy protections for substance use disorder (SUD) records created by an SUD program under 42 CFR Part 2 (Part 2). This reform was pursuant to a statutory mandate under the CARES Act.  These Part 2 reforms have a general compliance date of February 16, 2026.

While the rule primarily applies to SUD programs that are subject to Part 2, certain changes apply to all HIPAA covered entities, including those that are not Part 2 programs, since many receive SUD records from Part 2 programs for treatment and care coordination purposes.

So, any HIPAA covered entities that create, maintain, receive or transmit any SUD treatment information should review and make appropriate updates to their HIPAA Notice of Privacy Practices (NPP) by February 16, 2026. 

What Needs to Change for Most HIPAA Covered Entities?  

For most HIPAA covered entities, the NPP revisions must address: 

1. Update for SUD Use and Disclosures. The NPP should have a specific disclosure of how the entity may use and disclose SUD records and how Part 2 protections are more stringent than HIPAA.
2. Disclosure in Legal Proceedings. Include a provision that SUD records may not be disclosed in legal proceedings against the patient without a specific written consent or court order.
3. Fundraising. In order to use or disclose Part 2 records for fundraising, the covered entity must first provide the patient with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
4. Redisclosure. Provide notice to the patient that information disclosed pursuant to the HIPAA Privacy Rule may be subject to redisclosure by the recipient and no longer protected by the HIPAA Privacy Rule.

What About Part 2 Programs?

In addition to the NPP revisions described above, the Part 2 final rule significantly expands the separate Part 2 patient notice of privacy practices that Part 2 programs are required to provide. The specific updates for Part 2 programs include: 

1. Conformance to HIPAA. The thrust of the final rule revisions was to conform the Part 2 notice with the HIPAA requirements. Providers who are both a HIPAA covered entity and Part 2 program may, but are not required to, issue a consolidated notice.
2. Required Headings. The regulation has specific language that must be included on a record header or otherwise prominently displayed on the Part 2 patient notice of privacy practices.
3. Use and Disclosures. The notice must include an explanation of how the entity uses and discloses SUD records.
4. Single Patient Consent. A statement that a patient may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes, and that this may be revoked.
5. Patient Rights. Discussion of patients’ rights with respect to their SUD records.
6. Other Required Statements. Significant additional new requirements, including relating to re-disclosure, the Part 2 program’s duties, complaints, and contact information.

The 2024 final rule also instituted other reforms to the Part 2 rules that have a February 16, 2026 compliance date. These updates should be reviewed closely well in advance of that deadline in order to ensure compliance.