If your practice has not yet updated its HIPAA Notice of Privacy Practices (NPP), action is overdue. Effective February 16, 2026, all HIPAA-covered health care providers are required to revise their NPP to reflect new federal rules governing the confidentiality of substance use disorder (SUD) treatment records under 42 C.F.R. Part 2 (“Part 2”). These changes stem from the CARES Act and a 2024 HHS final rule that aligned Part 2 more closely with HIPAA while preserving heightened protections for SUD patient records.
Importantly, this obligation is not limited to practices that specialize in SUD treatment. The updated NPP requirements apply to any HIPAA-covered health care provider that creates or maintains Part 2 records — including providers who receive SUD treatment records from other sources in the course of treating a patient, such as through care coordination, referrals, or integrated care arrangements. In other words, if your practice could receive records identifying a patient as having received SUD diagnosis, treatment, or a referral for treatment at a federally assisted program, your NPP must address Part 2’s requirements.
The changes require NPPs to include the following:























