HIPAA compliance requirements continue to evolve, and recent court decisions have understandably drawn significant attention.
Last summer, we examined these developments in our Workplace Privacy Report article, analyzing how a Texas federal district court decision affected the HIPAA Reproductive Health Privacy Rule and why a subsequent Supreme Court decision may change that outcome. The analysis remains an important resource for understanding the current state of reproductive health privacy under HIPAA. While the litigation has curtailed significant portions of the Reproductive Health Privacy Rule, the related requirement to update Notices of Privacy Practices (NPPs) was not affected by the Texas court decision and appears to remain enforceable. As a result, covered entities should confirm their NPPs comply by the February 16, 2026, deadline.
At the same time, covered entities and employer-sponsored health plans should not lose sight of a separate — and firmly in place — HIPAA compliance obligation: updating their NPPs to address substance use disorder (SUD) records, also by February 16, 2026.
The U.S. Department of Health and Human Services (HHS) finalized a 2024 rule revising the Confidentiality of Substance Use Disorder Patient Records to more closely align certain parts of the HIPAA Privacy Rule with rules relating to certain federally funded substance abuse treatment programs. That rule also introduced specific notice obligations for covered entities that create, receive, maintain, or transmit SUD information. All HIPAA-covered entities that handle such SUD records must update their NPPs.
Importantly, this obligation is not limited to traditional substance use treatment programs. Health plans, employers, and other covered entities may be subject to the updated notice requirements if they receive or maintain these records as part of care coordination, payment, or other health care operations.
HHS has not issued an updated model NPP reflecting either of these changes; covered entities and plan sponsors should therefore work with counsel to draft appropriate NPP language and confirm their distribution/posting procedures before the February 16, 2026, deadline.
Members of the Jackson Lewis Employee Benefits and Privacy Practice Groups can help if you have questions or need assistance. Please contact a Jackson Lewis employee benefits team member or the Jackson Lewis attorney with whom you regularly work. Subscribe to the Benefits Law Advisor Blog here.