As we have discussed in previous blogs, there have been a number of recent changes to the HIPAA privacy rule requiring action from plan sponsors. As you will likely recall, in December of 2024, all health plans covered by HIPAA were required to update their HIPAA policies to incorporate additional protections for reproductive health information. After several challenges, a federal court has now blocked this rule, removing the requirement for health plans. Although most plans updated their policies to comply with the law, it is now recommended that these provisions be removed.
While the reproductive rule is no longer in effect, recent federal rulemaking has introduced new notice requirements related to substance use disorder treatment, aligning current privacy protections more closely with HIPAA.
Historically, 42 C.F.R. Part 2 information (“Part 2”) imposed stricter confidentiality rules on substance use disorder (“SUD”) records than HIPAA, including heightened consent standards and limitations on redisclosure. The new rules aim to make it easier to coordinate care and reduce administrative complexity by better aligning Part 2 with HIPAA.
Under the updated rules, health plans covered by HIPAA that create, receive, or maintain Part 2 information must update their HIPAA Notice of Privacy Practices to expressly address the use and disclosure of this information. Specifically, the notice must inform individuals that:
- Certain SUD records are subject to additional confidentiality protections under federal law;
- Uses and disclosures of Part 2 information may be subject to stricter limitations than other protected health information; and
- Individuals have specific rights related to the protection of their Part 2 information, including protections against certain types of redisclosure.
Plan sponsors must review and revise their Notice of Privacy Practices to clearly describe how substance use disorder records are protected by February 16, 2026. If your health plan posts its privacy notice on its website, it doesn’t need to send out a special mailing for this change. Instead, the plan can simply post the updated notice online by the date the change takes effect. Then, the next time you send out a mailing on the plan, you can include either the full revised notice or a quick summary of what changed and how to get the updated version.
If you don’t have your notice posted on a website, you must distribute the updated notice (or at least explain what changed and how to get the new version) within 60 days of the effective date of the new notice (i.e., by April 17, 2026).
If we prepared the HIPAA policies and procedures for your health plan, we will be reaching out to you about next steps. If you have any questions about the new rule, please reach out to any of the attorneys on our Employee Benefits team or HIPAA team.
