Reminder: Required Updates to HIPAA Notice of Privacy Practices and Distribution of Part 2 Patient Notice

At a Glance

• HHS’s 2024 final rule aligning confidentiality requirements for substance use disorder treatment programs covered under 42 CFR Part 2 with HIPAA also requires HIPAA-covered entities (CEs) that are not Part 2 programs, but that receive or maintain patient records from Part 2 programs, to update their own notices of privacy practices (NPPs) to describe how CEs are permitted to use or disclose the Part 2 program records.
• CEs are required to make changes by February 16, 2026. As it often takes time to update and re-post NPPs, CEs may want to start making changes soon.

Background

As you may recall, in February 2024, the U.S. Department of Health & Human Services through the Substance Abuse and Mental Health Services Administration and the Office for Civil Rights issued a final rule (Final Rule) modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (Part 2). The Final Rule more closely aligns the confidentiality requirements for Part 2 programs with HIPAA, and, among other things, requires Part 2 programs to issue patient notices, similar to the notices of privacy practices (NPPs) required by HIPAA’s Privacy Rule. 

The Final Rule also requires HIPAA-covered entities (CEs) that are not Part 2 programs, but that receive or maintain patient records from Part 2 programs, to update their own NPPs to describe how the CEs are permitted to use or disclose such Part 2 program records. The Final Rule requires CEs to update their NPPs by February 16, 2026. 

In general, CEs that receive Part 2 program records from a Part 2 program pursuant to a general authorization allowing the program to use and disclose the records for treatment, payment and operations purposes are permitted to use and disclose such records in accordance with HIPAA. CEs that receive Part 2 program records pursuant to a specific patient authorization issued to the CE or a third party may use and disclose the records only in accordance with the terms of the authorization. 

In both cases, the Final Rule prohibits CEs from using or disclosing Part 2 program records, or testimony that describes the information contained in the Part 2 program records, in any civil, criminal, administrative or legislative proceedings by any federal, state or local authority, against the patient who is the subject of the Part 2 program record, unless specifically authorized by (1) the patient or (2) the order of a court after it provides the patient with notice of the court order. 

Compliance and Next Steps

To comply with the Final Rule, CEs that are not Part 2 programs may want to revise their NPPs to include language similar to the following in the section of the NPP that lists the ways CEs can use and disclose protected health information without patient consent:

SUD Treatment Information. If we receive or maintain any information about you from a substance use disorder treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment or health care operations, we may use and disclose your Part 2 Program record for treatment, payment and health care operations purposes as described in this Notice. If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us.

In no event will we use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order. 

CEs are required to make changes by February 16, 2026. As it often takes time to update and re-post NPPs, CEs may want to start to make changes soon. 

As described above, CEs that have Part 2 programs also are required to have their own patient notice of how Part 2 program records may be used and disclosed. Part 2 programs must roll out their patient notices by the same deadline of February 16, 2026, but can begin use of the patient notice now if preferred. Also note that CEs also may be required to update their HIPAA-required privacy policies to describe how they will implement the required protections for Part 2 program records. 

For More Information

For further information, you may contact the authors.