Group Health Plans Must Update HIPAA Notices by February 16 to Address New SUD Privacy Rules

Covered entities, including group health plans, must update and distribute their Health Insurance Portability and Accountability Act of 1996 (HIPAA) Notice of Privacy Practices (NPP) by February 16, 2026, to comply with new rules for handling substance use disorder ) records.

SUD records are records protected under 42 C.F.R. Part 2 (Part 2) that originate from federally assisted treatment programs (Part 2 Programs). Historically, Part 2 imposed very stringent limitations on the handling of SUD records in an effort to encourage treatment and reduce stigma.

The Coronavirus Aid, Relief, and Economic Security Act (the CARES Act) eased some of the burdens related to the use and disclosure of SUD records, particularly for purposes of treatment, payment, and healthcare operations. In accordance with the CARES Act, the Department of Health and Human Services (HHS) issued a final rule in February 2024 that aligns the regulations under Part 2 with the HIPAA Privacy Rule. While the February 2024 final rule provides for increased uses and disclosures of SUD records, it still requires privacy measures that are more rigorous than HIPAA’s protections for other types of protected health information (PHI). This means covered entities that receive or maintain SUD records must adhere to enhanced privacy requirements when handling those records.

HHS issued another final rule in April 2024 that, among other things,^[1]requires covered entities to update their NPPs to address the heightened privacy requirements that apply to SUD records.

Beginning February 16, 2026, group health plans must update their NPPs to address the following:

• The uses and disclosures of SUD records, including the requirement for written consent; and
• The prohibition on the use of SUD records and testimony in civil, criminal, administrative, and legislative proceedings against a patient, absent a specific patient consent or a court order.

The updates to the NPP to address uses and disclosures of SUD records is a material change, so group health plans will need to promptly distribute the revised NPP. If a group health plan posts its NPP on its website, it may distribute the revised NPP by posting it to the website by the NPP’s new effective date. A group health plan that posts its NPP on its website should provide a hard copy of the revised NPP in its next annual mailing. If a health plan does not post its NPP on a website, it must provide the revised NPP (or information about the material change and how to obtain the revised NPP) within 60 days of the NPP’s new effective date. Electronic delivery via email is permitted to individuals who have agreed to electronic notice and have not withdrawn their agreement.

However, not all group health plans are required to issue their own NPPs. Typically, fully insured group health plans may rely on their insurer to update and issue their NPPs if they do not create or receive PHI beyond enrollment data or summary health information. Group health plans that receive more extensive disclosures of PHI are required to maintain their own NPPs.

Winston Takeaways

Plan sponsors should determine if and how the new Part 2 requirements apply to their group health plan and review their NPPs accordingly. Plan sponsors should also review whether and how PHI and SUD records travel through their systems and consult with any vendors that handle SUD records to ensure compliance. This may also require updates to business associate agreements for vendors that handle SUD on behalf of the group health plan.

Please contact a member of the Winston & Strawn Employee Benefits and Executive Compensation Practice or your Winston relationship attorney for further information.

---

[1] The April 2024 final rule also implemented certain privacy requirements for protected health information related to reproductive healthcare. The portions of the rule related to reproductive healthcare were vacated in June 2025 by the U.S. District Court for the Northern District of Texas (Purl v. U.S. Dep’t of Health and Human Servs, No. 2:24-CV-00228, 2025 WL 17081137 (N.D. Tex. June 18, 2025). The appeal was voluntarily dismissed in September 2025 (Purl v. U.S. Dep’t of Health and Human Servs, No. 25-10743 (5th Cir. Sept. 10, 2025).