Written by Margaret Young Levi

The February 16, 2026 deadline is fast approaching for HIPAA covered entities to revise their HIPAA Notice of Privacy Practices to address substance use disorder (SUD) records.

In 2024, the U.S. Department of Health & Human Services (HHS) issued a Final Rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”). This Final Rule was designed to better align Part 2 record protections with HIPAA.

Although the Final Rule primarily applies to Part 2 programs, all HIPAA covered entities that receive SUD records from Part 2 programs will need to update their Notice of Privacy Practices by February 16, 2026. This requirement applies to not only health care providers but also health plans, including health insurance companies, health maintenance organizations (HMOs), as well as employer-sponsored health plans.

For additional information about this Final Rule, please check out the HHS Fact Sheet.

Looking for assistance in this area? We regularly work with our clients regarding their policies and procedures related to compliance with HIPAA and other data privacy and security laws and regulations.  If you are looking for assistance in this area, contact Kathie McDonald-McClure at (502) 562-7526 or Margaret Young Levi at (859) 288-7469. To learn more about Bricker’s health care, data privacy and cyber security practice, visit the following Wyatt website pages: Wyatt Data Privacy & Cyber- Security and Wyatt Health Care.