All HIPAA covered entities had to update their Notice of Privacy Practices (NPP) on February 16, 2026, to reflect new federal rules protecting substance use disorder (SUD) treatment.
New federal rules more closely align HIPAA’s privacy protections with 42 CFR Part 2, the separate federal law governing SUD treatment records. As part of that alignment, the U.S. Department of Health and Human Services (HHS) required all HIPAA covered entities to update their NPPs to explain an individual’s rights regarding SUD patient records, even if the covered entity is not an SUD treatment program.
An outdated NPP is a red flag that signals to government regulators that a covered entity’s HIPAA compliance program is deficient. Covered entities that missed the February compliance deadline are not alone, but they can and must correct it now.
Who This Applies To
This applies to more organizations than many realize. The updated NPP requirement applies to covered entities that create, receive, maintain, or transmit SUD records subject to Part 2, which includes far more organizations than addiction treatment specialists.
Physician practices, hospitals, health plans, and other covered entities that hold any SUD-related information in a patient’s broader medical record must comply, even if SUD treatment isn’t their focus.
Separately, organizations that are themselves Part 2 programs, meaning they’re federally assisted providers of SUD diagnosis, treatment, or referral, face a more extensive set of required updates to their Part 2-specific notice.
- The Revised HIPAA NPP: Every HIPAA covered entity (whether treating SUD patients or not) must update its standard NPP. The revised version now includes specific language regarding the privacy of SUD records.
- The New Part 2 SUD NPP: This is a specialized notice. It is required for covered entities that participate in Part 2 Programs (providing SUD diagnosis, treatment, or referral). This notice is more robust, explaining the specific protections and limitations unique to SUD records, and the patient’s right to request restrictions on disclosures for treatment, payment, and health care operations (TPO) if they have paid out-of-pocket in full.
What Changed in the NPP
For all covered entities
For covered entities that may handle or receive Part 2 records, the updated NPP generally needs to:
- Explain the heightened protections that apply to SUD treatment records. Part 2 imposes stricter limitations on use and disclosure than standard HIPAA protections, even for treatment, payment, and healthcare operations, and patients need to be told that in plain language.
- Address redisclosure. The notice must explain that information disclosed under the HIPAA Privacy Rule may be subject to redisclosure by the recipient and, once redisclosed, is no longer protected under HIPAA.
- Reflect current, real-world data sharing practices, including how information moves through integrated care arrangements, care coordination relationships, and digital health platforms, rather than describing outdated or generic disclosure practices.
For Part 2 program providers
Organizations that are Part 2 programs face additional requirements for their separate Part 2 notice, including specific required headers and detailed descriptions of which disclosures require patient consent versus which are permitted without it. A provider that is both a HIPAA covered entity and a Part 2 program may combine these into a single consolidated notice, but isn’t required to.
Why So Few People Are Talking About This
There’s a simple reason this deadline hasn’t drawn much attention: it’s a narrow, technical update overshadowed by much bigger HIPAA news. The proposed Security Rule overhaul, with its mandatory MFA and encryption requirements, and the pending Privacy Rule changes affecting patient access rights have dominated the compliance conversation this year.
An NPP update tied specifically to SUD records and Part 2 alignment simply doesn’t generate the same headlines, even though it’s one of the few HIPAA compliance dates in 2026 that was actually binding rather than proposed.
That’s exactly why it’s worth flagging directly. A missed or outdated NPP is a documented, easily identifiable compliance gap, the kind of finding that surfaces quickly during an OCR investigation or audit.
Why This Matters: A Real-World Example
Imagine a patient in long-term recovery from alcohol use disorder. Part of their recovery includes taking medication to help them maintain sobriety. The medication was prescribed as part of treatment that qualifies as a Part 2 program under federal law.
That same patient later sees their dentist for a tooth extraction, or their primary care doctor after a minor injury. Either provider might consider prescribing an opioid painkiller, but the patient’s existing medication will block it from working. The patient discloses it, and it becomes part of their chart, at an office that has nothing to do with addiction treatment and isn’t itself a Part 2 program.
Here’s what most patients don’t realize: that piece of information doesn’t lose its extra protections just because it’s now in a primary care or dental record. Under the Part 2 alignment rules, it’s still subject to Part 2’s stricter confidentiality requirements wherever it ends up.
So if that primary care office later receives a routine-looking request for records, say, from an auto insurer after a car accident, a new employer’s pre-placement health screening, or an attorney in a custody dispute, ordinary HIPAA rules might otherwise permit sharing the full chart without any special step. But because this particular piece of information originated in SUD treatment, it generally can’t be redisclosed the same way as the rest of the record without the patient’s specific consent.
That’s precisely what the updated NPP is supposed to tell patients upfront: if they have SUD treatment history anywhere in their broader medical record, it carries protections that follow it, even to providers who never treated the SUD itself, and the patient has a say before it moves any further.
What to Do Now
If you haven’t reviewed your NPP against these requirements yet:
- Check the NPP currently posted in your office and on your website. What is the effective date? If it’s before February 16, 2026, update it.
- Post the updated NPP in the facility and on your website
- Print the updated NPP to hand out to patients
- Verify that your NPP is accessible where patients would look for it, both in physical locations and on your website, because an updated notice that isn’t posted doesn’t satisfy the requirement.
- If you’re a Part 2 program, confirm your separate Part 2 notice meets its own distinct header and disclosure requirements, rather than assuming your HIPAA NPP update covers both.
At The HIPAA E-Tool®, we incorporated these updates, along with the broader SUD and Part 2 alignment changes, into our policies and forms ahead of the February deadline. If you’re a customer and haven’t reviewed how this affects your organization, now is a good time to do so. And if this is the first you’ve heard of this deadline, you’re exactly who this post is for.
