Update to HIPAA Notice of Privacy Practices Due February 16

Sponsors of health benefit plans are required to make a Notice of Privacy Practices (Notice) available to covered members under HIPAA.  No significant revisions to the Notice have been required since the HITECH Act rules of 2013, but new revisions must be implemented by February 16, 2026.

In 2024, the U.S. Department of Health and Human Services issued final rules strengthening privacy protections for substance use disorder (SUD) records created by an SUD program under 42 CFR Part 2 (Part 2).  Pursuant to a statutory mandate under the CARES Act, these Part 2 reforms have a general compliance date of February 16, 2026.

While the final rules primarily apply to SUD programs that are subject to Part 2, certain changes apply to all HIPAA covered entities, including those that are not Part 2 programs, since many receive SUD records from Part 2 programs for treatment and care coordination purposes.

Since plan sponsors are HIPAA covered entities that create, maintain, receive, or transmit SUD treatment information, they must update their Notice by the deadline in the following areas:

·         Use and disclosure – how the entity may use and disclose SUD records and how Part 2 protections are more stringent than HIPAA.

·         Disclosure in legal proceedings – SUD records may not be disclosed in legal proceedings against the member without a specific written consent or court order.

·         Fundraising – in order to use or disclose Part 2 records for fundraising, the covered entity must first provide the member with a clear and conspicuous opportunity to elect not to receive any fundraising communications.

·         Redisclosure – information disclosed pursuant to the HIPAA Privacy Rule may be subject to redisclosure by the recipient and no longer protected by the HIPAA Privacy Rule.

ASR will provide updated Notices in our clients’ Compliance Documents for distribution to covered plan members before the deadline.

If you have questions on the updated Notice, call ASR Health Benefits at (616) 957-1751 or (800) 968-2449.