To comply with HIPAA Privacy Regulations, by February 16, 2026, all HIPAA covered entities are required to update their Notice of Privacy Practices (“NPP”) to address the use and disclosure of substance use disorder (“SUD”) treatment records that covered entities may receive from a SUD treatment program subject to 42 CFR Part 2 (“Part 2 Program”).
The updates to the NPP are required even if the covered entity itself does not provide SUD services and is not itself considered a Part 2 Program. As part of such updates, the NPP is required to address:
- How the covered entity may use and disclose SUD treatment records received from a Part 2 Program.
- The patient’s right to be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications before SUD treatment records will be used for fundraising for the benefit of the covered entity.
- Prohibition on using or disclosing SUD treatment records received from a Part 2 program or testimony that describes the information contained in such records in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against the patient unless based on the patient’s written consent or a court order.
In addition, under the 2024 Final Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR Part 2, which aligned the Part 2 requirements with HIPAA, by February 16, 2026, all Part 2 Programs are required to update their NPPs and Part 2 compliance policies to include the requirements of the updated regulations. Organizations that are both HIPAA covered entities and Part 2 Programs may choose to issue a combined NPP that addresses both HIPAA and Part 2 requirements or may issue separate NPPs that address such requirements.
If you have questions about the required updates to the NPP, policies, or compliance with HIPAA or 42 CFR Part 2, please contact your Thompson Coburn attorney.
