Important HIPAA Updates for Confidentiality of Substance Use Disorder Treatment

The deadline for updating and distributing HIPAA Notices of Privacy Practices (NPP) concerning the confidentiality of substance use disorder (SUD) treatment information is set for February 16, 2026. Health plan sponsors and healthcare providers need to evaluate and implement necessary updates as outlined in 45 C.F.R. §164.520 to ensure regulatory compliance and maintain patient confidentiality.

These updates might necessitate changes beyond the NPP documentation. Entities should assess if revisions are required for HIPAA privacy policies and practices, training materials, and business associate agreements handling SUD treatment records. This stems from the U.S. Department of Health & Human Services' (HHS) modifications under 42 CFR part 2, enhancing coordination among SUD treatment providers and aligning with HIPAA privacy standards.

It is crucial to consider other applicable laws that may impose stricter privacy conditions on SUD records than HIPAA. Any use or disclosure of such records must align with the relevant legal standards, as outlined in 45 CFR §164.520(b)(1)(ii). Meanwhile, due to a federal district court ruling in Texas, revisions for reproductive health-related protected information may not be immediately required. Legal counsel should be consulted for guidance.

Additionally, starting January 28, 2026, adjustments to HIPAA’s civil monetary penalties for inflation will affect privacy and security compliance. Entities should stay informed and consult with legal counsel to ensure they meet all compliance requirements while safeguarding sensitive client information.