Model Notices of Privacy Practices; Office for Civil Rights Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records (Feb. 13, 2026)
HHS has updated its model Notice of Privacy Practices (NPP) materials to help covered entities and business associates comply with the Part 2 related NPP requirements that became enforceable on February 16, 2026. The materials include a model HIPAA health plan NPP, model HIPAA provider NPP, and a Model Part 2 Patient Notice that federally assisted Part 2 programs can use to satisfy the Part 2 patient-notice obligation (and that Part 2 programs that are also HIPAA covered entities or business associates may combine with a HIPAA NPP). As background, Part 2 rules apply to federally assisted programs that provide substance use disorder (SUD) diagnosis, treatment, or referral (including programs providing education, prevention, training, treatment, rehabilitation, or research for SUD). Some of the rules also extend to anyone who receives Part 2 records, including HIPAA covered entities and business associates. HHS finalized major updates to the Part 2 rules in 2024, implementing statutory reforms enacted in the CARES Act to better align those rules with the HIPAA privacy rule (while retaining heightened protections for Part 2 records).
The updated model notices were revised in February 2026. They are designed as plain language templates that covered entities can tailor with their own information, and incorporate the required Part 2-related revisions, including the requirement that HIPAA covered entities and business associates must include information about SUD records in their NPPs. Use of the models is optional; what is mandatory is that each covered entity’s NPP includes the applicable required content by the compliance deadline. HHS has also announced that OCR’s civil enforcement program for confidentiality of SUD patient records begins February 16, 2026, with penalties aligned to HIPAA’s enforcement mechanisms. HHS has also provided guidance for Part 2 programs on breach reporting and launched an online Part 2 breach portal in conjunction with its civil enforcement authority.
EBIA Comment: While Purl v. HHS vacated most of the 2024 HIPAA reproductive health care privacy rule, the Part 2-related NPP revisions survived and were required to be implemented by February 16, 2026. Covered entities should determine whether Part 2 information is being maintained (including through business associates and other vendors). If so, the revised model notices can be a useful starting point, but plan sponsors should ensure that the final NPP language aligns with their actual practices and administration, and should coordinate updates with insurers, TPAs, and counsel. Given OCR’s announcement of a civil enforcement program for confidentiality of SUD patient records, plan sponsors, group health plans, and business associates that receive and disclose information related to SUDs should act quickly to understand their obligations. For more information, see EBIA’s HIPAA Portability, Privacy & Security manual at Sections II.M (“Core Privacy Requirements”), XXIII.S (“Reproductive Health Care Privacy”), XXVII.G (“Right to Receive Notice of Privacy Practices”), and XXXIV.E (“Federal Substance Use Disorder Rule”).
Take your tax and accounting research to the next level with Checkpoint Edge and CoCounsel. Get instant access to AI-assisted research, expert-approved answers, and cutting-edge tools like Advisory Maps and State Charts. Try it today and transform the way you work! Subscribe now and discover a smarter way to find answers.
