Missed the HIPAA Deadline? Don’t Panic, Health Care Entities Can Still Update Privacy Practices and Policy Notices | Fox Rothschild LLP
https://www.jdsupra.com/legalnews/missed-the-hipaa-deadline-don-t-panic-4720721/
Publish Date: 2026-02-27 09:15:00
Source Domain: www.jdsupra.com
Government’s New Model Notice of Privacy Practices Provides a Roadmap
Key Points
- Recent changes to HIPAA regulations and the federal regulations regarding substance use disorder (SUD) treatment records under 42 CFR Part 2 (Part 2) required three changes by Feb.16, 2026.
- All providers that have SUD treatment programs subject to Part 2 (Part 2 Providers) must now publish Notices of Privacy Practices (NPPs).
- Providers that are HIPAA-covered entities but do not have a substance abuse program subject to Part 2 must update their NPPs.
- Health plans (including employer sponsors of self-insured group health plans) must update their published NPPs.
Coming to the rescue of providers that waited to make the required changes to their Notices of Privacy Practices regarding SUD treatment records, the federal government itself waited until February 16 to update its model Notice of Privacy Practices to provide sample language that can be used to update or help draft NPPs for Part 2 compliance.
What prompted the new Part 2 requirements and why are they important?
Providers with Part 2 substance abuse treatment programs[1] have long had separate requirements covering the confidentiality of their Part 2 records. Changes were made in the last two years to align Part 2 more closely with HIPAA. This is important because the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), the “HIPAA policeman,” is now also responsible for enforcing violations of Part 2, which were previously enforced by SAMHSA (the Substance Abuse and Mental Health Services Administration). OCR has already announced the launch of its new enforcement program, encouraging the submission of complaints. See: Office for Civil Rights Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records.
What are the requirements for HIPAA Covered Entities that do not have Part 2 substance abuse treatment programs?
Health care providers that do…
