The U.S. Department of Health and Human Services (HHS) has issued a final rule that requires covered entities—including many health plans—to update their Notice of Privacy Practices (Privacy Notice). This change enhances privacy protections for highly sensitive Substance Use Disorder (SUD) treatment records.
Why the Update is Necessary
The HIPAA Privacy Rule already mandates that covered entities provide a Privacy Notice to explain how an individual’s Protected Health Information (PHI) is used.
However, the April 2024 final rule specifically addresses patient records involving SUD treatment from federally assisted programs (often referred to as “Part 2 programs”). Any covered entity that receives or maintains these Part 2 records must now update their Privacy Notice to reflect these additional, heightened protections.
The mandatory deadline for updating and distributing these notices is February 16, 2026.
Required Employer Actions by Plan Type
Employers sponsoring health plans must determine their level of responsibility based on their plan’s funding structure and access to PHI.
Next Steps for Employers: Employers with self-insured health plans, or fully insured plans that manage PHI, must immediately begin the process of updating their Privacy Notices to incorporate the new requirements for SUD treatment records. It is currently uncertain if HHS will release updated model privacy notices before the deadline.