The U.S. Department of Health and Human Services has released updated model Notices of Privacy Practices (NPPs) to reflect recent regulatory changes. These updates affect health plans, covered health care providers, and certain substance use disorder treatment programs, and apply beginning February 16, 2026.
What the Notice of Privacy Practices Is
Under the HIPAA Privacy Rule, covered entities must provide individuals with a written notice explaining:
- How their health information may be used and disclosed
- Their rights regarding personal health information
- The organization’s privacy responsibilities and safeguards
The notice must be clear, accessible, and available to anyone who requests it, and it must also be posted prominently on any website that provides information about services or benefits.
What Changed in 2026
The updated guidance now requires covered entities to include information about the privacy protections for substance use disorder (SUD) records governed by federal confidentiality rules commonly known as “Part 2.”
Beginning February 16, 2026:
- HIPAA covered entities must incorporate SUD privacy protections into their Notices of Privacy Practices
- Federally assisted SUD treatment programs must issue a new patient notice aligned with HIPAA privacy standards
- Organizations that are both HIPAA covered entities and Part 2 programs may provide a combined notice
These changes stem from the 2024 Part 2 Final Rule and related HIPAA Privacy Rule updates intended to better align confidentiality protections across healthcare settings.
New Model Templates Available
HHS has published updated model templates to help organizations meet the revised requirements. Separate models are available for:
- Health care providers
- Health plans
- Part 2 patient notices
Organizations may use these templates and customize them with their own information. The goal is to improve patient understanding while helping regulated entities comply with the updated rules.
What Employers and Plan Sponsors Should Consider
Employers sponsoring group health plans should coordinate with carriers, TPAs, or legal counsel to confirm whether their privacy notice needs updating. If the plan is responsible for issuing its own HIPAA notice, revisions may be required to include the new substance use disorder confidentiality language.
Key Takeaway
The updated model notices expand required disclosures to address substance use disorder record protections and better align HIPAA and Part 2 privacy requirements. Covered entities should review their current privacy notices now to ensure they meet the February 2026 requirements and remain properly posted and available upon request.
Benefit Allocation Systems (BAS) provides best-in-class, online solutions for: Employee Benefits Enrollment; COBRA; Flexible Spending Accounts (FSAs); Health Reimbursement Accounts (HRAs); Leave of Absence Premium Billing (LOA); Affordable Care Act Record Keeping, Compliance & IRS Reporting (ACA); Group Insurance Premium Billing; Property & Casualty Premium Billing; and Payroll Integration.
MyEnroll360 can Integrate with any insurance carrier for enrollment eligibility management (e.g., Blue Cross, Blue Shield, Aetna, United Health Care, Kaiser, CIGNA and many others), and integrate with any payroll system for enrollment deduction management (e.g., Workday, ADP, Paylocity, PayCor, UKG, and many others).
This article is for informational purposes only and is not intended as legal, tax, or benefits advice. Readers should not rely on this information for taking (or not taking) any action relating to employment, compliance, or benefits. Always consult with a qualified professional before making decisions based on this content.
