QUESTION: Our company sponsors a group health plan with several vendors (a third-party administrator, care management vendor, and behavioral health vendor). We understand that HHS has updated one of the model notices of privacy practices (NPPs) and there are new Part 2-related NPP requirements. When did we need to update our HIPAA NPP, are HHS’s model notices required, and what does the new Part 2 enforcement program mean for plan sponsors and business associates?

ANSWER: If your plan (or any of its business associates) creates, receives, maintains, or transmits information that qualifies as Part 2-protected substance use disorder (SUD) patient records, then your plan should treat the Part 2-related NPP revisions as mandatory content requirements that are enforceable as of February 16, 2026.  As background, the Part 2 rule refers to 42 CFR Part 2—i.e., the federal regulations governing the confidentiality of SUD patient records. Part 2 primarily applies to SUD treatment programs that are subject to the rule, as well as to “lawful holders” that receive SUD records from a Part 2 program. HIPAA requires certain NPP changes for many HIPAA covered entities—even if they are not Part 2 programs— since many receive SUD records from Part 2 programs for treatment, care coordination, and payment purposes. Key points for plan sponsors, group health plans, and business associates include—

To dig deeper, visit the original article on the Thomson Reuters blog.