January 13, 2026
HIPAA covered entities (including employer health plans) must update their Notices of Privacy Practices (“NPP”) by February 16, 2026, to comply with the 2024 HIPAA Privacy Rule amendments.
An NPP explains how an individual’s health information is used, disclosed, and protected and outlines individuals’ rights under HIPAA. The 2024 HIPAA updates require additional and specific disclosures in the NPP to address the use and disclosure of substance use disorder (“SUD”) treatment records that HIPAA covered entities could receive from a SUD treatment program subject to 42 CFR Part 2 (“Part 2”). NPPs must be updated by February 16, 2026.
These mandatory updates stem from the 2024 Final Rule issued by the Department of Health and Human Services (“HHS”) that amended the HIPAA Privacy Rule to address reproductive health information and substance use disorder confidentiality rules (which we previously wrote about here). Although most of the 2024 Final Rule was struck down by a federal court (including those provisions related to reproductive health information), the Part 2-related provisions, including the requirement to update NPPs to address SUD treatment records, remain intact. HHS has not yet released model NPP language for these changes, but McGrath North has language available for covered entities that need to revise their NPPs.
NPPs have gone largely unchanged for years, but this marks the first significant update in a long time, and likely not the last. There are already rumblings of broader HIPAA revisions on the horizon, making this an opportune moment for plan sponsors to review their compliance plan and prepare for additional changes.
Even if NPPs were recently distributed, McGrath North can review your NPPs to confirm compliance and determine whether a new round of notices will be required in February.
New Year, New HIPAA Notice!
By: Britni Summers and Rachel MeyerHIPAA covered entities (including employer health plans) must update their Notices of Privacy Practices (“NPP”) by February 16, 2026, to comply with the 2024 HIPAA Privacy Rule amendments.
An NPP explains how an individual’s health information is used, disclosed, and protected and outlines individuals’ rights under HIPAA. The 2024 HIPAA updates require additional and specific disclosures in the NPP to address the use and disclosure of substance use disorder (“SUD”) treatment records that HIPAA covered entities could receive from a SUD treatment program subject to 42 CFR Part 2 (“Part 2”). NPPs must be updated by February 16, 2026.
These mandatory updates stem from the 2024 Final Rule issued by the Department of Health and Human Services (“HHS”) that amended the HIPAA Privacy Rule to address reproductive health information and substance use disorder confidentiality rules (which we previously wrote about here). Although most of the 2024 Final Rule was struck down by a federal court (including those provisions related to reproductive health information), the Part 2-related provisions, including the requirement to update NPPs to address SUD treatment records, remain intact. HHS has not yet released model NPP language for these changes, but McGrath North has language available for covered entities that need to revise their NPPs.
NPPs have gone largely unchanged for years, but this marks the first significant update in a long time, and likely not the last. There are already rumblings of broader HIPAA revisions on the horizon, making this an opportune moment for plan sponsors to review their compliance plan and prepare for additional changes.
Even if NPPs were recently distributed, McGrath North can review your NPPs to confirm compliance and determine whether a new round of notices will be required in February.
Related Attorneys
