HHS Updates Model HIPAA Privacy Notices for Part 2 Records

On Feb. 13, 2026, the U.S. Department of Health and Human Services (HHS) released updated model HIPAA Notices of Privacy Practices (Privacy Notices) for health plans and health care providers to use.

HIPAA covered entities must update their Privacy Notices if they receive or maintain patient records regarding substance use disorder (SUD) treatment provided by a federally assisted treatment program (i.e., a “Part 2 program”). The deadline for making this update was Feb. 16, 2026. According to HHS, its updated model notices reflect the changes for Part 2 records.

In addition, HHS broadened its online portal for filing privacy complaints to include complaints that SUD records were shared in violation of Part 2’s requirements.

Highlights

• Part 2 is a federal law that protects the confidentiality of patient records for individuals receiving services for SUDs, which are called Part 2 records.
• Self-insured health plans and fully insured health plans that maintain their own HIPAA Privacy Notices should ensure their notices are updated for the new privacy requirements for Part 2 records.
• HHS has updated its model Privacy Notices to incorporate the new protections for Part 2 records. Health plans that use the model notice should customize it by entering their own information.

HIPAA Privacy Notice

The HIPAA Privacy Rule generally requires covered entities to develop and distribute a Privacy Notice that provides a clear, user-friendly explanation of individuals’ rights with respect to their protected health information (PHI) and the entity’s privacy practices.

Self-insured health plans must maintain and provide their own Privacy Notices at enrollment time, when there is a material change to the notice and upon request. Special rules apply to fully insured health plans, which generally make the health insurance issuer, and not the health plan itself, primarily responsible for the Privacy Notice. Under these special rules:

• Fully insured health plans that do not have access to PHI (other than enrollment and summary health information) are not required to maintain or provide a Privacy Notice.
• Fully insured health plans that have access to PHI must maintain a Privacy Notice and provide it upon request.

Updates for Part 2 Records

Federal law protects the privacy of patient records related to SUD. The law applies to federally assisted programs providing education, prevention, training, treatment, rehabilitation, or research for SUD. The law provides safeguards and procedures for using and disclosing Part 2 records, including criteria for court orders to authorize disclosure of SUD records.

A final rule issued by HHS in April 2024 requires covered entities to update their HIPAA Privacy Notices if they receive or maintain Part 2 records. The updated Privacy Notices must address how the covered entity may use and disclose Part 2 records, the entity’s responsibilities with respect to the records and individuals’ privacy rights. The deadline for updating Privacy Notices for these additional privacy protections was Feb. 16, 2026.

Previously, HHS maintained model Privacy Notices in various formats (e.g., booklet, full-page, layered, and text-only versions) and provided Spanish translations for each format. In connection with updating its model Privacy Notices to incorporate the requirements for Part 2 records, HHS consolidated its model notices to single text-only versions for health plans and health care providers.