The U.S. Department of Health and Human Services (HHS) released updated model HIPAA Notices of Privacy Practices (Privacy Notices) for health plans and providers. HIPAA covered entities that handle substance use disorder (SUD) records from federally assisted “Part 2 programs” were required to update their Privacy Notices by February 16, 2026. The new models incorporate these Part 2 changes, and HHS has also expanded its online portal to accept reports of improper sharing of SUD records.
HIPAA’s Privacy Rule requires most health plans to provide a clear, easy-to-understand Privacy Notice explaining how they protect members’ health information and what rights members have.
Self-insured plans must distribute their own notice at enrollment, whenever it changes, and upon request. For fully insured plans, the insurance carrier is usually responsible for the Privacy Notice. If the plan does not access PHI (beyond enrollment and summary data), it does not need to provide a notice; if it does access PHI, it must maintain a notice and provide it on request.
Federal law strictly protects the privacy of SUD records for any federally assisted program. In April 2024, HHS issued a final rule requiring covered entities that receive or maintain Part 2 records to update their HIPAA Privacy Notices to explain how they use and disclose these records, their responsibilities, and individuals’ rights. The deadline to implement these updates was February 16, 2026. HHS has also streamlined its model Privacy Notices into single text-only versions for health plans and healthcare providers.
Download the bulletin for more details.