Entities covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), such as group health plans, that receive or maintain substance use disorder (SUD) treatment records from programs subject to federal requirements must ensure that their Notice of Privacy Practices (NPP) complies with new regulations by February 16, 2026. Employers that sponsor self-funded group health plans should review their current NPP and make necessary changes to maintain compliance ahead of this important compliance deadline.
What Is Changing in NPPs?
In 2024, the Department of Health and Human Services (HHS) issued a final rule modifying the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) under HIPAA. The Privacy Rule requires HIPAA-covered entities to update their NPP to reflect new requirements for protecting SUD records, as mandated by Congress in the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020.
SUD records include information pertaining to the patient’s identity, diagnosis, treatment, and billing, and any other information relating to a patient (including communications, such as emails or voicemails).
To be in compliance, the NPP must state in plain language that SUD treatment records (and testimony regarding the content of those records) shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual, unless (1) the individual provides written consent or (2) a court orders the use or disclosure of the records after the individual is provided with notice and an opportunity to be heard. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.
The 2024 Privacy Rule also addressed protected health information related to reproductive health care, as we previously explained. However, those aspects of the rule were vacated by a district court last summer. Therefore, covered entities are no longer legally required to implement the vacated rule’s restrictions, and covered entities that previously amended their NPP to reflect them may reverse those changes. Covered entities may also choose, however, to maintain enhanced privacy protections for protected health information related to reproductive health care to align with participant expectations, subject to applicable state laws.
Updating, Posting, and Distributing the NPP
Many plan administrators currently provide a NPP that is based on the HHS model template that first became available in 2013. While we expect HHS to update its model to reflect the new standards for SUD treatment records, HHS may not release a revised version in time for the compliance deadline. In the absence of a revised model, plan administrators that use the model template may consider going off template or addressing the new requirements in one of the model’s customizable text boxes.
Group health plans are required to provide the NPP to all participants upon initial enrollment in the plan and upon request. They must also notify participants of the availability of the NPP and how to obtain it at least once every three years. The NPP and periodic notice of its availability may be distributed by email to participants who have agreed to receive electronic disclosure, and such agreement has not been withdrawn.
In addition to the normal distribution requirements, plans that maintain a website must post an updated NPP that complies with the regulations by February 16, 2026, and then distribute the updated NPP, or notice of its availability, in its next annual mailing to individuals then covered by the plan. For plans that do not maintain a website, the updated NPP, or notice of its availability, should be distributed to all participants within 60 days of the changes, or by April 17, 2026.
