Action Required: Update Your Notice of Privacy Practices for Part 2 Records

Takeaways

• Covered entities, including group health plans, should review and update their Notices of Privacy Practices (NPP) by February 16, 2026.
• New HHS rules require NPPs to clearly explain how Part 2 records are treated differently from other protected health information.
• Employers sponsoring self-insured health plans are generally responsible for compliance, while insurers typically handle updates for fully insured plans.

---

In 2024, the U.S. Department of Health and Human Services issued final rules requiring covered entities to revise their Notices of Privacy Practices (“NPPs”) to address substance use disorder records, commonly referred to as “Part 2 records.” Covered entities, including group health plans, must update their NPPs to comply with these requirements by February 16, 2026.

Part 2 records have always been subject to heightened confidentiality protections, but the rules governing coordination of care and disclosure have been inconsistent. The new requirements are intended to close that gap by requiring covered entities to clearly explain how Part 2 records are treated differently from other protected health information.

Under the final rules, NPPs must now specifically describe, among other things:

• Limitations on the use of substance use disorder treatment records in legal proceedings;
• When and how Part 2 records may be disclosed for treatment, payment, and healthcare operations; and
• Required notices regarding redisclosure of Part 2 information.

These requirements apply not only to providers that directly treat substance use disorders, but also to entities that receive Part 2 records for care coordination or other permitted purposes.

Covered entities are not required to mail revised NPPs to individuals by the February 16 deadline. Instead, compliance may be achieved by posting the updated NPP on the entity’s website, provided that the update is completed by February 16, 2026. For fully insured plans, the insurer will generally be responsible for preparing the updated NPP, while for self-insured plans, the obligation typically falls on the employer as plan sponsor.

Group health plan sponsors should review and update their NPPs to ensure they accurately reflect the new Part 2 requirements.

If you have any questions about the information in this alert, please contact your relationship attorney or any member of the Employee Benefits and Executive Compensation Practice Group.