Many people see the start of a new year as a time to refresh and renew themselves. For covered entities under HIPAA, which include group health plans, it’s also time to refresh and renew your HIPAA Notice of Privacy Practices (Privacy Notice) to address the changes made to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (Part 2). The deadline for updating Privacy Notices to reflect these amendments is February 16, 2026.
The Privacy Notice is a document required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to describe how a covered entity may use or disclose individuals’ protected health information to carry out treatment, payment, health care operations, and for other purposes permitted by law. The Privacy Notice also sets out the covered entities’ legal obligations concerning protected health information and describes individuals’ rights to access and control their protected health information. As noted above, most group health plans are considered covered entities for purposes of HIPAA.
In February 2024, we provided additional details on the final rule amending Part 2 to more closely align Part 2 with HIPAA and the deadline for updating the Privacy Notices. The Part 2 regulations are generally designed to govern the confidentiality of SUD patient records maintained by certain “Part 2 programs,” which is a category of information distinct from the protected health information protected by HIPAA. Although group health plans are not “Part 2 programs,” they may receive patient records that would be protected under Part 2. As a result, group health plans are also required to update their Privacy Notices to reflect these Part 2 requirements and provide individuals with information about how Part 2 records can be used or disclosed.
Note that, as discussed in our August 2024 post, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services previously issued a Final Rule modifying HIPAA’s privacy rule in order to support reproductive health care privacy, and these changes were also to be included in the updated Privacy Notices due by February 16, 2026. However, in June 2025, a federal court vacated the portion of the final rule that enhanced those privacy protections, as further discussed here. If a group health plan’s Privacy Notice had been previously updated to include references to the vacated rules, those should generally be removed.
Action Steps: Fully insured plan sponsors should confirm with their insurers that their Privacy Notices are updated for these changes by February 16, 2026. Self-funded plan sponsors often maintain and distribute their own Privacy Notices. Accordingly, they should review and potentially revise their current Privacy Notices to comply with Part 2 no later than February 16, 2026.
