The HIPAA Privacy Rule requires covered entities like health plans and health care providers to provide individuals with a Notice of Privacy Practices. This notice discusses how their protected health information (PHI) may be used and discloses what rights they have regarding that information.
A final rule issued by the U.S. Department of Health and Human Services (HHS) in April 2024 requires covered entities that receive or maintain substance use disorder (SUD) treatment records from a federally assisted “Part 2 program” to update their Privacy Notices. These notices must now specifically address how Part 2 program records are used, disclosed, and protected. The Privacy Notices must be updated to include:
- A description of any use or disclosure that is prohibited or significantly restricted by other applicable laws, including rules for Part 2 programs;
- A statement that SUD treatment records from Part 2 programs cannot be used or disclosed in any civil, criminal, administrative, or legislative proceeding against an individual without the individual’s written consent or a court order; and
- If a covered entity uses or discloses Part 2 program records for fundraising, it must first give the individual a clear, prominent opportunity to opt out of receiving any fundraising communications.
The deadline to update Privacy Notices to reflect these additional protections for Part 2 program records is February 16, 2026.
Action Steps
Employers that maintain Privacy Notices for their health plans should update them to reflect the new SUD treatment record rules and, for self‑insured plans, distribute the revised notices by February 16, 2026. Download the bulletin for more details.
