To help HIPAA covered entities comply with updated rules for substance use disorder patient records, the U.S. Department of Health and Human Services Office of Civil Rights has published updated language for Notices of Privacy Practices. The three model notices available here address: (i) HIPAA Health Care Providers; (ii) HIPAA Health Plans; and (iii) Part 2 Patient Notices.
As of February 16, 2026, these HIPAA covered entities are required to include information about substance use disorder (SUD) patient records (described in 42 U.S.C. 290dd-2(a) and 42 CFR part 2 (“Part 2”)) in their notice of privacy practices (NPP).
www.hhs.gov/...
