Notice of Privacy Practices Deadline Approaching

Plan sponsors of group health plans should be aware of an upcoming February 16, 2026, deadline to revise HIPAA Notices of Privacy Practices (“NPPs”) to reflect changes required by a 2024 Final Rule (“Final Rule”) regarding privacy practices for Part 2 records.

What is changing?

Covered entities, including group health plans, should revise their NPPs to reflect the additional privacy protections for Part 2 records.

Briefly, a Part 2 record refers to a medical record that has information about a person’s substance use disorder (“SUD”) where the record is made by a SUD treatment program. There may be instances where the group health plan receives or maintains Part 2 records. Under the Final Rule, covered entities must update their NPPs to reflect how such records are protected by the covered entity and limitations on their use and disclosure.

Notices should be updated and included in materials going forward and posted to the covered entity’s website (if applicable). For example, if the employer sponsors a group health plan and maintains a website for group health plan information, the revised NPP should be posted there.

Is another mailing of the NPP needed?

Not necessarily.

When there is a material change in the NPP, a health plan that posts its notice on its website must post the revised notice on its website by the effective date of the change (February 16, 2026) and provide the revised notice in the next annual mailing to individuals covered by the plan.

If the notice is not posted on the plan’s website, then the revised NPP or information about the material change and how to obtain the revised NPP should be furnished to the primary insured covered by the plan within 60 days of a material revision. The notice may be provided electronically if an individual has agreed to receive the notice in that manner.

Note. If a NPP was furnished in connection with open enrollment for 2026, it may have already been updated to comply with this requirement.

Is there a model notice?

The Department of Health and Human Services (“HHS”) maintains model notices of privacy practices for group health plan covered entities. These model notices have not been updated for the changes related to Part 2 records. While it is expected that HHS will update their model versions, it’s not clear whether it will be done by this compliance deadline.

Are there other changes required?

The 2024 Final Rule included additional protections for reproductive protected health information (“rPHI”). Among other things, this required updating the NPP to correspond to new protections for rPHI. However, as previously reported, a federal court vacated the provisions of the Final Rule relating to rPHI. Therefore, updates to the NPP to address rPHI are no longer required. If an NPP was updated to reflect this information, it should be revised accordingly.

Employer Action

• For fully insured health plans, the carrier is responsible for the NPP. No action is required by employers.
  • The group health plan should maintain a copy of the carrier’s NPP and provide upon request.
• For self-funded health plans (including major medical, dental, health FSAs, and HRAs), the covered entity is the self-funded health plan. Employers sponsoring a self-funded health plan will want to ensure they have an updated NPP by the deadline.
  • A third-party administrator (“TPA”) or administrative vendor may provide the NPP on behalf of the covered entity.