Healthcare privacy law is evolving — and February 16, 2026 is a firm compliance deadline for new federal privacy requirements that affect how clinics handle and communicate about substance use disorder (SUD) treatment records. These changes come from HHS’s update aligning 42 CFR Part 2 (confidentiality of SUD records) with the HIPAA Privacy Rule.
What’s Changing? The Part 2 Final Rule
HHS, in coordination with SAMHSA and OCR, finalized amendments to Part 2 to better align it with HIPAA protections. The updated rule:
- Allows a single patient consent for all future uses/disclosures for treatment, payment, and healthcare operations, simplifying consent workflows.
- Permits HIPAA-regulated entities to redisclose SUD records under HIPAA’s Privacy Rule once valid consent is obtained.
- Removes the need to segregate Part 2 records in many cases, reducing administrative burdens.
- Applies HIPAA’s breach notification and enforcement framework to Part 2 violations, with civil monetary penalties and OCR enforcement authority.
- Maintains enhanced confidentiality protections for SUD treatment information, especially concerning disclosures in legal proceedings and sensitive situations.
NPP Update Deadline: February 16, 2026
One of the most immediate actions clinics must take is updating their Notice of Privacy Practices (NPP) to include the revised Part 2 elements.
Who must update the NPP?
✔ All HIPAA covered entities.
What must be in the updated NPP?
✔ Clear information about how Part 2 records may be used or disclosed.
✔ Patients’ specific rights under the new Part 2 framework (e.g., rights to restrict disclosures or request accounting of disclosures).
✔ Limitations on redisclosure of Part 2 records, particularly legal restrictions.
✔ A conspicuous opt-out option if SUD records may be used in fundraising communications.
Important to remember: It’s not just internal policies — this updated NPP must be made available to patients in your clinic and posted wherever your current NPP is displayed (on your website, in-office postings, and patient intake packets).
Why This Matters
Failing to update your policies and Notices of Privacy Practices by February 16, 2026 could expose you to enforcement actions, fines, and complaints to the HHS Office for Civil Rights. Part 2 violations are now subject to the same enforcement mechanisms used under HIPAA.
We’ve Got You Covered — Updated NPP Included for Subscribers
If you’re a Policy Manual subscription client, we’ve already taken care of this change for you:
✔ We updated your Notice of Privacy Practices to include the required Part 2 language and brought your documents into compliance with the February 16, 2026 deadline.
✔ The updated NPP was emailed to you this week as an attachment from the first email we sent — so check your inbox (and junk folder, just in case).
✔ These updates are part of your subscription — no extra work needed from your team.
Not a Subscriber Yet? Here’s How We Can Help
Updating legal policies like your NPP isn’t something you want to scramble to do at the last minute — and getting it wrong can have serious consequences.
With a Policy Manual subscription with us, you receive:
- Regularly updated HIPAA and compliance policies
- New templates aligned with current federal rules like Part 2
- Peace of mind knowing your documents stay up to date
- Notifications and support when changes like this happen
Contact HSA today to learn how our subscription services help your clinic stay compliant — so you don’t have to do it all yourself.