Little Health Law Blog
If your practice has not yet updated its HIPAA Notice of Privacy Practices (NPP), action is overdue. Effective February 16, 2026, all HIPAA-covered health care providers are required to revise their NPP to reflect new federal rules governing the confidentiality of substance use disorder (SUD) treatment records under 42 C.F.R. Part 2 (“Part 2”). These changes stem from the CARES Act and a 2024 HHS final rule that aligned Part 2 more closely with HIPAA while preserving heightened protections for SUD patient records.
Importantly, this obligation is not limited to practices that specialize in SUD treatment. The updated NPP requirements apply to any HIPAA-covered health care provider that creates or maintains Part 2 records — including providers who receive SUD treatment records from other sources in the course of treating a patient, such as through care coordination, referrals, or integrated care arrangements. In other words, if your practice could receive records identifying a patient as having received SUD diagnosis, treatment, or a referral for treatment at a federally assisted program, your NPP must address Part 2’s requirements.
The changes require NPPs to include the following:
- Explain that SUD treatment records subject to Part 2 carry heightened confidentiality protections and, unlike most other protected health information, generally require the patient’s written consent before being used or disclosed for treatment, payment, or health care operations.
- State in plain language that Part 2 records — and testimony about their contents — may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against a patient without (1) the patient’s written consent, or (2) a court order accompanied by a subpoena or other legal mandate.
- Identify the limited circumstances in which SUD records may be used or disclosed without consent (such as medical emergencies, reporting suspected child abuse, or disclosures to qualified service organizations).
Once updated, the NPP must be posted prominently in your office, made available to any patient who requests a copy, and — if your practice maintains a website that describes your services — posted prominently on that website as well.
We are available to assist with reviewing your current NPP, drafting an updated and compliant version, or assessing whether and how Part 2 requirements apply to your specific practice. Please contact our office at 404-685-1662 (Atlanta), 706-722-7886 (Augusta), or info@littlehealthlaw.com.