On February 13, 2026, the Department of Health and Human Services (HHS) released updated HIPAA model notice templates for health plans and health care providers. These updated notices include provisions related to changes made under the 2024 HIPAA Privacy Rule Final Rule that align HIPAA requirements with other rules protecting substance use disorder (SUD) information. Group health plan sponsors that are required to update their plans’ Notice of Privacy Practices by February 16, 2026 to align with the 2024 HIPAA Privacy Final Rule can use the model notice template found here under the title “HIPAA Health Plan NPP.” For more information related to this update, please review the information included below.

Background

Previously, federal regulations protected patients seeking treatment for a SUD from legal, professional or personal consequences under a provision of Part 2 of Title 42¹. These regulations apply to any federally assisted healthcare provider or facility (i.e., any facility or provider that directly or indirectly receives federal funding) that provides patients with SUD diagnosis, treatments or referrals. These federally assisted health facilities or providers are typically referred to as “Part 2 programs”. This rule also applies to “lawful holders,” which include any entity that receives SUD records from a Part 2 program, including primary care providers, health plans, and social service agencies. Although a group health plan may also be considered a “lawful holder” of substance use disorder records, this article is specifically focused on group health plans as covered entities under HIPAA, and their obligation to provide an updated HIPAA Notice of Privacy Practices.

CARES Act and HIPAA Privacy Final Rules

In February of 2024, HHS adopted requirements under the CARES Act (Coronavirus Aid, Relief, and Economic Security Act) to update the above Part 2 programs’ rules and create greater consistency with HIPAA rules, furthering the federal government’s intent to protect patients who seek SUD treatment from discrimination and reputational damage. Among other protections and changes, these rules required Part 2 programs to update patient notices. Thereafter, in April of 2024, HHS amended the HIPAA Privacy Rules (hereinafter referred to as the “HIPAA Privacy Final Rules”) to include new requirements protecting reproductive health care records, and to include Part 2 programs in the Notice of Privacy Practices requirements that apply across SUD programs and other entities (including group health plans) that use, disclose, or receive SUD records. Under the HIPAA Privacy Final Rules, HIPAA Covered Entities, including group health plans, must incorporate updates relating to how they handle SUD records into their Notice of Privacy Practices, including a statement that Part 2 SUD program records cannot be used in any criminal, administrative, legislative or civil action, without patient consent or court order.

In June of 2025, the portion of the HIPAA Privacy Final Rules relating to reproductive rights was vacated by a federal court,² as you can read in the Brown & Brown article linked here detailing the ramifications of the court’s decision. The court, however, did not vacate the portion of the HIPAA Privacy Final Rules related to Part 2 program SUD records and the Notice of Privacy Practices updates. Therefore, the protections for SUD records and the requirement that plan sponsors must update their Notice of Privacy Practices to include the protection of information relating to SUD treatment continues to be effective despite this court decision.

Updated HIPAA Notice of Privacy Practices for Group Health Plans

Under the HIPAA Privacy Final Rule, individuals seeking SUD treatment benefit from stricter confidentiality protections related to their SUD records. The purpose of the updated Notice of Privacy Practices is to inform individuals receiving or considering SUD treatment of their rights and protections, thereby encouraging them to seek help without fear of discrimination.

Group health plans that receive, maintain, use, or disclose Part 2 program SUD records must update their Notice of Privacy Practices no later than February 16, 2026, and may do so using the model notice released by HHS that includes the language required by the HIPAA Privacy Final Rules. Group health plans and plan administrators/plan sponsors may also want to consider adopting the more stringent Part 2 program requirements imposed under the HIPAA Privacy Final Rules. Additionally, if the plan is subject to ACA Section 1557 rules (that is, it receives federal funding through HHS or HHS programs such as the retiree drug subsidy program), it should incorporate language assistance services into the Notice of Privacy Practices.

Due to the complexity of each group health plan’s HIPAA obligations, it is extremely important for group health plan sponsors to discuss with their legal counsel the specific obligations they may have as it relates to HIPAA, and what provisions they may specifically need to include in their updated Notice of Privacy Practices by February 16, 2026.

¹ https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
² Purl v. US Department of Health and Human Services

Regulatory and Legislative Strategy Group