Amendments in 2024 to the HIPAA Privacy Rule require that health care providers who create or receive substance use disorder (SUD) treatment-related records must update their HIPAA Notices of Privacy Practices (NPP). The compliance date is February 16, 2026.  

The Rule amendments impose stricter confidentiality requirements for SUD treatment-related records under 42 USC § 290dd-2 and 42 CFR Part 2, if applicable. Substance Use Disorder treatment-related records, including those received by the provider from a SUD treatment provider covered by Part 2, will in many instances be subject to Part 2 protections, even if the records recipient does not operate a SUD treatment program regulated under Part 2.

What updates are required for notices of privacy practices (NPPs)?

1.    Determine whether your practice setting receives these types of records. Even if it does not, it would not hurt to include basic updates.

2.    Include a separate statement that all SUD treatment-related records received from SUD providers regulated under Part 2, or any testimony conveying the contents of such records, cannot be "used or disclosed in civil, criminal, administrative, or legislative proceedings against" the person who received such treatment without his or her consent, or upon a court order issued after notice and hearing, as provided in Part 2. Any court order authorizing the use or disclosure of SUD treatment-related records must be accompanied by a subpoena or other legal requirement compelling disclosure before any such disclosure is made.

3.    If a provider intends to use or disclose SUD treatment-related records as part of fundraising efforts, the NPP must notify the person who received SUD treatment "with a clear and conspicuous opportunity" to opt out of receiving any fundraising communications. 

Make necessary updates should by February 16, 2026. Comprehensive information on these requirements is in TMA’s online Law Guide topic on “Medical Records,” starting on page 14. The document is online at tnmed.org/legal.