This article is written by the American Institute of Healthcare Compliance Audit Education Department
By February 16, 2026, all HIPAA-covered entities—including healthcare providers, health plans, and healthcare clearinghouses—that create, receive, or maintain Substance Use Disorder (SUD) records subject to 42 CFR Part 2 must update their Notice of Privacy Practices (NPP). The update requires clearly detailing enhanced protections for SUD records. The information in this AIHC update is not legal or consulting advice, but for educational purposes to prompt compliance.
Does this new rule apply to my organization?
Yes, it can, but this requirement is specifically targeted at those handling Part 2 records. Entities must ensure their websites and privacy policies reflect these changes by February 16, 2026. Covered entities, including health plan sponsors and providers, must align their notices with the new, stricter privacy rules for sensitive SUD information by this date.
Tips to Update Your NPP
The NPP must contain the elements, information and statements specified in 45 CFR 164.520 and must include a specific header, a description of permitted uses/disclosures (treatment, payment, operations), individual rights, covered entity duties, and contact information for complaints.
It must be provided by the first service date and, as of February 16, 2026, align with updated substance use records regulations.
Key elements mandated by 45 CFR 164.520 include:
- Required Header: A specific statement regarding how medical information is used and the patient's rights.
- i.e., “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”1
- Permitted Uses and Disclosures: A detailed description of how the covered entity may use or disclose Protected Health Information (PHI) without the patient’s written authorization,2 including for treatment, payment, and healthcare operations.
- Individual Rights: Information on the right to access, amend, request restrictions, receive confidential communications, and receive an accounting of disclosures.
- A statement that other uses or disclosures will only be made with the individual’s authorization, and that the individual has the right to revoke her/his authorization subject to certain limitations.3
- A summary of certain specified rights the individual has concerning his/her information.4
- Covered Entity Duties: Statements confirming the entity's responsibility to protect privacy, provide notice of privacy practices, and abide by the terms of the notice.
- Complaints Procedure: Instructions on how individuals can file complaints with the covered entity or the Secretary of Health and Human Services (HHS).
- Contact Information: A designated person or office to contact for further information.
- Effective Date: The NPP’s effective date.5
- Special Considerations: Specific language regarding the restriction of uses/disclosures for underwriting purposes, the sale of PHI, and marketing, as well as updated, clearer descriptions regarding substance use disorder records.
- Posting the Notice: The NPP must be prominently posted on the entity's website and physically at the service location by February 16, 2026 and, for plans without a website, distributed to participants by April 17, 2026 (within 60 days of the change).
Key Considerations:
Update Policies & Retrain Workforce - Organizations should act promptly to review their existing notices and implement the required changes before the deadline. Review and update internal privacy policies, procedures, and training materials to comply with the final rule.
Review your BAAs - Business Associate Agreements should be reviewed to ensure they account for the enhanced protections of SUD information.
For more information, check the updated Fact Sheet 42 CFR Part 2 Final Rule:
References:
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520
1 45 CFR 164.520(b)(1)(i)
2 45 CFR 164.520(b)(1)(ii)
3 45 CFR 164.520(b)(1)(ii)
4 45 CFR 164.520(b)(1)(iv)-(vii)
5 45 CFR 164.520(b)(1)(viii)
Copyright © 2025 American Institute of Healthcare Compliance All Rights Reserved