Effective February 16, 2026, the HIPAA Privacy Rule (“Privacy Rule”) requires that HIPAA covered entities update their Notice of Privacy Practices (“NPP”) to include information about substance use disorder (SUD) records (42 U.S.C. 290dd-2(a) and 42 CFR part 2). Federally assisted SUD treatment programs (“Part 2 Programs”) are also required to provide a new patient notice that is more closely aligned with the HIPAA NPP.
Key Requirements
Specifically, the NPP must provide adequate notice of the uses and disclosures of Part 2 records, and of individual rights and the covered entity’s legal duties with respect to those records under the Privacy Rule. Among other things, the NPP must state in plain language that to the extent a HIPAA covered entity has SUD treatment records subject to Part 2, that such information will not be shared for investigations or legal proceedings against an individual unless the individual provides written consent or a court orders the disclosure. The patient notice requirements for Part 2 Programs, similar but distinct from a traditional NPP, now require Part 2 Programs to provide individual patients with information about their rights regarding their information as well as how the Part 2 Program may use and disclose the patient’s information.
Resources and Next Steps
The U.S. Department of Health and Human Services (HHS) has issued model NPP templates that health care entities may use to comply with the new requirements. The templates, while similar, are distinct, as the Part 2 Program model notice contains more specific information that would be applicable to a Part 2 Program. The templates are available here: Model Notices of Privacy Practices | HHS.gov. To ensure compliance, HIPAA covered entities, including Part 2 Programs, should update their NPPs and training materials to align with these new changes. A health care provider that is both a HIPAA covered entity and a Part 2 Program, has the option of using a combined notice that complies with the requirements of a traditional covered entity and a Part 2 Program.
Gunster's Healthcare Law and Regulated Industries & Professions teams are here to help you navigate the new guidance. Please feel free to reach out to the contacts below with any questions:
|
850.521.1980 |
813.228.9080 |
YES! PLEASE SIGN ME UP TO RECEIVE EMAIL ALERTS FROM OTHER GUNSTER PRACTICE AREAS.
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
Gunster. Florida's Law Firm for Leaders.
As a full-service law firm, Gunster provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Coral Gables, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa, Vero Beach, and its headquarters in West Palm Beach. With more than 320 attorneys and consultants, and 300 committed support staff, Gunster is ranked among the top 200 largest law firms by the National Law Journal and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practices, industries, offices and news is available at www.gunster.com.
