Reminder: HIPAA Covered Entities and Substance Use Disorder Treatment Providers Must Update Notices of Privacy Practices by February 16, 2026

Two different updates to notices of privacy practices (NPPs) are due on February 16, 2026. First, HIPAA covered entities that create or receive substance use disorder (SUD) records that are subject to 42 CFR Part 2 (Part 2) must revise their HIPAA NPPs to reflect Part 2's more stringent requirements. Second, SUD treatment programs that are subject to Part 2 as "Part 2 Programs" must revise their Part 2 NPPs. If an entity is both a HIPAA covered entity and a Part 2 Program, then it may maintain separate NPPs or combine them.

Part 2

Under Part 2, SUD treatment records are subject to heightened confidentiality protections to prevent discrimination and fear of prosecution, which may deter individuals from seeking treatment. Part 2 primarily regulates Part 2 Providers, which are federally assisted programs. "Federal assistance" is defined to include a broad range of federal benefits, such as participating providers in the Medicare program, providers registered to dispense controlled substances to treat SUDs, and even providers whose only federal assistance is tax exempt status. "Programs" include specialty facilities that hold themselves out as providing and provide SUD services (e.g., behavioral health facilities), identified units within general medical facilities that hold themselves out as providing and provide SUD services (e.g., addiction treatment units or inpatient psychiatric units), and a general medical facility's medical personal or other staff whose primary function is the provision of SUD services and who are identified as SUD providers (such as an emergency department clinician whose primary function is screening for SUDs or providing detoxification services).

Part 2 also regulates "lawful holders" who receive SUD records from a Part 2 Program based on either a patient's written consent and an accompanying notice of disclosure indicating the records are subject to Part 2 or based on one of Part 2's exceptions to consent requirements. For example, a patient may consent to a Part 2 Program disclosing SUD records to the patient's primary care provider. The Part 2 Program then may disclose the SUD records to the primary care provider, along with a notice that the records are subject to Part 2 and a copy of the patient's consent. The primary care provider then qualifies as a "lawful holder" of the Part 2 records. Health plans also frequently qualify as lawful holders under Part 2.

2024 HIPAA and Part 2 Amendments

In 2024, two different sets of amendments impacted SUD records. First, in February 2024, the U.S Department of Health and Human Services ("HHS") Office for Civil Rights ("OCR") implemented requirements under the Coronavirus Aid, Relief, and Economic Security ("CARES") Act to modernize Part 2 and align its requirements under HIPAA. While the Part 2 final rule expanded permitted uses and disclosures for treatment, payment, and health care operations, it preserved heightened protections for SUD records to address concerns about stigma and discrimination. Part 2 requires Part 2 Programs to provide patients with a Part 2 NPP. The February 2024 rule includes substantial changes to Part 2's requirements for Part 2 NPPs, such as new required text for the NPP's header.

In April 2024, OCR amended the HIPAA Privacy Rule to create greater safeguards for the privacy of reproductive health care. The April 2024 rule included new requirements for HIPAA NPPs related to the new reproductive health care protections. The April 2024 rule also included new HIPAA NPP requirements related to SUD records that are subject to Part 2. The reason OCR included these changes in the April 2024 rule, rather than the February 2024 rule, is because HIPAA only allows OCR to make revisions to HIPAA standards (e.g., HIPAA NPP requirements) once a year. Accordingly, OCR did not include the HIPAA NPP changes in the February 2024 rule but instead included them alongside the reproductive health care changes in the April 2024 rule.

In June 2025, the District Court for the Northern District of Texas vacated almost all of the April 2024 rule in Purl v. U.S. Dep't of Health and Human Services. The only portion of the April 2024 rule that the court did not vacate was the requirement to update HIPAA NPPs with respect to Part 2 SUD records. The appeal from the district court's vacatur order was voluntarily dismissed after the government declined to file a brief in the Fifth Circuit in support of the vacated rule.

Required Updates to the HIPAA NPP

The requirement to update HIPAA NPPs is not limited to Part 2 providers. Any covered entities processing Part 2 records (whether Part 2 Programs or "lawful holders") must revise their NPPs to include:

• Notice of Uses and Disclosures: Inform individuals about the uses and disclosures of Part 2 SUD records, including the requirement for written patient consent for treatment, payment, and health care operations. The revised notice must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by the HIPAA Privacy Rule and other applicable law and must identify and describe if a use or disclosure is materially limited by other applicable law (e.g., is more stringent than HIPAA), such as Part 2.
• Rights and Legal Duties: Describe patient rights and legal obligations specific to Part 2 SUD records, including limitations on redisclosure.
• Transparency in Legal Proceedings: Include a statement explaining that Part 2 SUD records cannot be used in civil, criminal, administrative, or legislative proceedings without patient consent or a court order.
• Fundraising Opt-Out: If Part 2 SUD records will be used for fundraising, provide individuals with a clear opportunity to opt out of receiving fundraising communications.

Required Updates to the Part 2 NPP

The February 2024 rule completely overhauled the requirements for Part 2 NPPs. The new requirements include, but are not limited to:

• Revised Headers: Required language for the Part 2 NPP's header, which is different from the required language for a HIPAA NPP's header.
• Permitted Uses and Disclosures: Descriptions of uses and disclosures of Part 2 SUD records, both those permitted without patient consent and those that specifically require patient consent.
• Part 2 Rights: Identification of the patient's Part 2 rights.
• Part 2 Program Obligations: Statements regarding the Part 2 Program's duties.

HHS has clarified that an organization may combine their HIPAA and Part 2 NPPs, as long as the combined notice includes all required information under 45 C.F.R. § 164.520 and 42 C.F.R. § 2.22. Because the two regulations include very different content requirements, however, combining the NPPs can lead to a very cumbersome notice. Covered entities that have Part 2 Programs may find it easier to keep the NPPs separate and only provide the Part 2 NPPs to Part 2 Program patients.

Next Steps

Prior to the February 16, 2026, deadline, organizations should consider the following:

• If a HIPAA covered entity, determine whether it receives or maintains Part 2 records and, if so, revise its HIPAA NPP. The regulation states that "[i]f a use or disclosure … is prohibited or materially limited by [Part 2], the description of such use or disclosure must reflect the more stringent law." This could be read to suggest that changes throughout the NPP are required, where every description of a use or disclosure is modified to reflect whether Part 2 is more stringent. Alternatively, some covered entities may instead choose to add a single section to their HIPAA NPP that addresses more stringent Part 2 requirements.
• If a Part 2 Program, completely revise its Part 2 NPP to reflect the requirements in the February 2024 rule.
• If both a covered entity and a Part 2 Program, determine whether to issue separate NPPs or a single combined NPP. This decision may be impacted by a number of factors, such as the percentage of patients who also are Part 2 Program patients and whether the Part 2 Program has a distinct patient registration process.
• Assess accessibility compliance: ACA Section 1557 final regulations continue to require at 42 C.F.R. § 92.11 that a HIPAA NPP include a notice of availability of language assistance services and auxiliary aids and services (except in Texas and Montana, where a district court has stayed the effective date of the ACA Section 1557 final regulations).

For assistance with these updates, please contact one of the authors of this alert or the Davis Wright Tremaine attorney with whom you work.