Background on HIPAA Privacy Notices and SUD PHI protections

Under HIPAA’s Privacy Rule, covered entities (i.e., health plans, healthcare providers and clearinghouses) must provide participants/patients with a Health Plan Notice of Privacy Practices (Privacy Notice) that describes both their rights related to their Protected Health Information (PHI) and the entity’s privacy practices. Self-insured group health plans must provide their Privacy Notices at enrollment time as well as whenever there is a material change to the notice and upon request. Fully insured group health plans that don’t have access to PHI are exempt from the notice requirement and may ask their insurer to provide Privacy Notices.

In 2024, HHS issued a final rule that strengthened privacy protections. This final rule requires covered entities that receive Part 2 records to update their HIPAA Privacy Notices to include information about the confidentiality protections that apply to those records. This requirement applies to plans as of February 16, 2026. We discussed this guidance in our May 16, 2024 insight, “New HIPAA Rule Will Require Updates to Policies and Notices.”

Part 2 is a federal law that protects the confidentiality of records for patients receiving services for SUDs from federally assisted Part 2 programs that provide SUD-related services. The Part 2 rules describe the confidentiality protections that apply to the use and disclosure of Part 2 SUD patient records.

The updated Model HIPAA Privacy Notices

On February 13, 2026, HHS released updated model notices to incorporate the new protections for Part 2 records:

• Model Notice of Privacy Practices for HIPAA Health Plan
• Model Notice of Privacy Practices for HIPAA Covered Health Care Provider (for healthcare providers)
• Part 2 Patient Notice (for federally assisted SUD treatment programs)

These model notices can be used immediately.

The updated online portal for filing privacy complaints

The HHS online portal for complaints is accessed via the Complaint Portal Assistant. The HHS website includes details on how to file a health information privacy complaint.

The OCR’s announcement about enforcing federal laws protecting SUD records

The OCR’s announcement of this new program refers to its intention to “aggressively” enforce federal safeguards to protect SUD patient records.

Under the program, the OCR is accepting complaints alleging violations of the regulation that protect the confidentiality of SUD patient records and notification of breaches of SUD patient records.

Implications for plan sponsors

Sponsors of health plans that use the HHS model notices can start using the updated models now.

Sponsors of health plans that have developed their own HIPAA Privacy Notices should be sure to update them to include the new information regarding SUD-related privacy rights.