HIPAA Covered Entity and Part 2 Program Updates to Notice of Privacy Practices

Under recent federal rulemaking, Part 2 Programs and HIPAA covered entities that process Part 2 Substance Use Disorder (SUD) records must update their Notice of Privacy Practices (NPP) by February 16, 2026.

Which Providers Are Affected?

Part 2 SUD records are those related to a federally-assisted substance use disorder treatment provider. Common examples include opioid treatment programs (OTPs), hospital-based addiction counselors and specialized residential or outpatient treatment facilities. Even if the covered entity is not a Part 2 provider, if it receives, maintains or transmits any SUD Part 2 records, the NPP revisions will apply.

Required HIPAA Revisions

HIPAA covered entities that process SUD records (but are not Part 2 providers) must update their NPPs to include, generally, the following:

1. SUD records have heightened confidentiality protections under federal law.
2. Uses and disclosures of SUD records are more strictly limited than uses and disclosures of other protected health information, including use and disclosure of SUD records for treatment, payment, and health care operations, which generally requires patients’ written consent.
3. Individuals have certain rights regarding the protection of their SUD records, including protection against certain redisclosures.
4. SUD records cannot be used in civil, criminal, or administrative proceedings against a patient without the patient’s consent or a court order.
5. If the covered entity uses SUD records for fundraising, the covered entity must provide conspicuous notice and an opportunity to choose not to receive communications related to fundraising.

Covered entities that are Part 2 Programs must update their Part 2 NPPs to include, generally, the following:

1. A revised NPP header which differs from the required HIPAA NPP header.
2. A description of permitted uses and disclosures of SUD records without patient consent and those which require specific patient consent.
3. Notification regarding patients’ rights.
4. Statements regarding the Part 2 Program’s obligations.

A Part 2 program can choose whether to implement these revisions as part of its HIPAA NPP or using a separate NPP that contains these requirements, as well as additional Part 2 Program notifications.

[View source.]