Articles

If you have not updated your Notice of Privacy Practices (NPP) to include language regarding substance use disorder records, you must do so no later than February 16, 2026.

This update is required as a result of the February 2024 Final Rule published by the Department of Health and Human Services (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR). This rule modifies the confidentiality requirements for substance use disorder records under 42 CFR Part 2 and aligns them more closely with HIPAA regulations.  This regulation not only requires substance use disorder treatment programs (Part 2) to comply but also covered entities (CE) that receive or maintain records from Part 2 programs.  Since there is a possibility that any CE may receive or maintain records from these programs, all CEs must update their NPP.

The updated NPP must explain how the practice uses and discloses records from Part 2 Programs. The following must be included:

• If the practice receives records through a general consent for treatment, payment, and/or health care operations, the practice may use and share those records for the same purposes under HIPAA.
• The practice cannot use or disclose Part 2 records in any civil, criminal, administrative, or legislative proceeding against the patient unless the patient provides written permission, or the court issues an order after notifying the patient.

Next Steps

Practices must use this time to update their Notice of Privacy Practices (NPP) to include language regarding handling substance use disorder records. In addition to the NPP, any copies given to patients, office posters, as well as the Notice posted on the practice website must also be updated.

As a reminder, all updates must be completed by February 16, 2026.

To assist our policyholders with implementation of these requirements, SVMIC provides an updated Sample Notice of Privacy Practices as well as an updated Poster. 

For those offices that wish to update their own notice, below is some sample language:

• Substance Use Disorder Records

If we receive or keep information about you from a substance use disorder treatment program covered by 42 CFR Part 2 (called a “Part 2 Program”) through a general consent you gave that program for treatment, payment, and/or health care operations, we may use and share your record for those same purposes as explained in this Notice.  We will never use or share your record, or any testimony about what is in your record, in any civil, criminal, administrative, or legislative proceeding by any federal, state, or local authority against you, unless you give written permission or a court issues an order after notifying you.

If you or someone in your office have questions about compliance with HIPAA or access to these resources, call 800-342-2239 or email Contact@svmic.com.