Required HIPAA Notice of Privacy Practices Changes Due
The HIPAA Notice of Privacy Practices (Notice) is a document that covered entities must make available to the public. Most covered entities are required to provide the Notice to patients, try to obtain acknowledgement of receipt, display it at their service locations and "prominently post" it on their websites. Many covered entities have not made significant changes to these Notices since the HITECH Act rules of 2013, but new revisions must be implemented by February 16, 2026.
Current regulations governing the HIPAA Notice of Privacy Practices, published at 45 C.F.R. Section 164.520, are somewhat outdated and do not incorporate a recent legal case related to the reproductive health information rule. Prior amendments to the Health Insurance Portability and Accountability Act (HIPAA) regulations relating to reproductive health information were vacated in June 2025 (view more information); however, the court decision vacating those rules left intact requirements for handling substance use disorder information protected under 42 C.F.R. Part 2 (Part 2).
Part 2 Programs that are also HIPAA covered entities are required to update both the HIPAA Notice of Privacy Practices and a specific Part 2 Notice of Privacy Practices. These Notice requirements may be satisfied using a single, combined Notice of Privacy Practices. Part 2 Program-specific Notice requirements can be found in the Part 2 regulations at 42 C.F.R. Section 2.22 and are substantially similar to the HIPAA Notice requirements.
The requirement to update the HIPAA Notice of Privacy Practices is not limited to Part 2 Programs. It also applies to HIPAA covered entities that are not Part 2 Programs but have received Part 2 records, including receipt from other covered entities or business associates. Part 2 contains provisions identifying when a recipient of a Part 2 record is subject to restrictions on uses and disclosures of Part 2 records that go beyond what HIPAA requires. There is no requirement to keep Part 2 records segregated from other records, and receipt of those records by a treating provider may not be readily apparent. Unless it is certain that a covered entity will never receive this type of data, the Notice must explain that certain uses and disclosures otherwise permitted by HIPAA are materially limited by Part 2. The Notice should also explain that Part 2 information may not be used or disclosed in civil, criminal, administrative or legislative proceedings against an individual except with a Part 2 form of patient consent or court order.
Though the U.S. Department of Health and Human Services' Office for Civil Rights may issue further guidance regarding the Notices, and additional changes may be coming in 2026 if the proposed rules to promote coordinated care and reduce administrative burden are finalized, covered entities should start preparing to implement required changes.