In the 2024 HIPAA Reproductive Health Care Rule (“RHC Rule”), the Department of Health and Human Services (“HHS”) updated the HIPAA Notice of Privacy Practice requirements to include information regarding the protection of certain substance-use disorder records (referred to as the “Part 2 Rules”). The Northern District of Texas vacated parts of the RHC Rule in Purl v. United States Dep’t of Health & Hum. Servs., but HHS has reiterated that updates to the HIPAA Privacy Notice for the Part 2 Rules remain in effect.
The HIPAA regulation governing HIPAA Privacy Notices (45 CFR section 164.520) includes a list of the required content, including the updates with respect to the Part 2 Rules. HHS has not indicated whether it will issue sample language and has not published any updates to its model notice.
Health plans must update their HIPAA Privacy Notice by February 16, 2016. However, note that under existing rules, group health plans that are fully insured and that do not access PHI may rely on the insurer to provide the HIPAA Privacy Notice. 45 CFR § 164.520(a)(3)(iii). That rule has not changed, so these fully insured group health plans can continue to rely on their health insurer to send the updated HIPAA Privacy Notice. These insurers must send the updated HIPAA Privacy Notice by February 16, 2026.
How should plans distribute the updated Notice?
Generally, revisions to the HIPAA Privacy Notice must be distributed within 60 days after a material change in the Notice content. But, if a health plan posts the HIPAA Privacy Notice on its website (or wherever enrollees access plan materials), it can provide the updated HIPAA Privacy Notice to enrollees at its “next annual mailing,” such as with enrollment materials or in its Summary Plan Description. 45 CFR §164.520(c)(1)(v). So, as long as a health plan updates its HIPAA Privacy Notice on its website by February 16, 2026, the health plan can wait to provide its updated HIPAA Privacy Notice to current enrollees at its next annual mailing. Health plans also should provide the updated HIPAA Privacy Notice upon request or to new enrollees (such as new hires) on or after February 16, 2026.
