The HIPAA Privacy Rule generally requires covered entities {health plans, health care providers and health care clearinghouses) to provide individuals with a Notice of Privacy Practices (or Privacy Notice) to ensure they understand how their protected health information (PHI} may be used and disclosed, as well as their rights with respect to PHI.
A final rule issued by the U.S. Department of Health and Human Services (HHS) requires covered entities to update their Privacy Notices if they receive or maintain patient records regarding substance use disorder (SUD) treatment provided by a federally assisted treatment program (i.e., a “Part 2 program”). Covered entities that receive or maintain Part 2 program records must update their Privacy Notices to include:
-
A description of any use or disclosure that is prohibited or materially limited by other applicable law, including the rules for Part 2 programs;
-
A statement that SUD treatment records received from Part 2 programs cannot be used or disclosed in a civil, criminal, administrative or legislative proceeding against the individual without either the individual’s written consent or a court order; and
-
If a covered entity intends to use or disclose Part 2 program records for fund raising purposes, a statement that the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
The deadline for updating Privacy Notices for the additional privacy protections for Part 2 program records is Feb. 16, 2026.
Action Steps
Employers that maintain Privacy Notices for their health plans should update them with the changes to SUD treatment records by Feb. 16, 2026. Employers with self-insured health plans should also distribute their updated Privacy Notices by this deadline.
Provided to you by Hodge, Hart & Schleifer
This Compliance Bulletin is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice. ©2025-2026 Zywave, Inc. All rights reserved.