Looming deadline for HIPAA covered entities handling substance use disorder records

Background

On February 16, 2024, the Department of Health and Human Services (HHS) issued a final rule (Part 2 Final Rule) intended to align the Part 2 rules, which protect SUD records and generally contain stricter protections than HIPAA, with HIPAA .¹ On April 26, 2024, HHS issued final revisions to the HIPAA Privacy Rule (HIPAA Final Rule) requiring health care providers, health plans, and health care clearinghouses to revise their NPPs to reflect the Part 2 Final Rule changes to synchronize HIPAA with Part 2. Covered entities processing SUD records must publish revised NPPs by February 16, 2026. 

Required NPP Updates

To be in compliance, the NPP must, in plain language: 

1. Notify individuals as to how the covered entity may use and disclose SUD records. 
2. Notify the individuals of their rights and the covered entity’s responsibilities regarding SUD records.
3. Where any use or disclosure is “prohibited or materially limited by other applicable law” including Part 2, the NPP should describe that limitation.
4. Explain that any SUD record protected health information that was disclosed may be subject to redisclosure.
5. Notify individuals that Part 2 records may not be used against the individual in civil, criminal, administrative, or legislative proceedings absent a written consent from the individual or a subpoena or similar legal mandate compelling disclosure.
6. In the unlikely event that a group health plan participates in fundraising activities, it must provide a “clear and conspicuous opportunity” for individuals to opt out of receiving fundraising communications before health information from Part 2 records is used for fundraising purposes.

The revised NPP must be posted on the group health plan’s website, and the revised NPP should be included in the next annual mailing to plan participants. 

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.

_{1 More specifically, with HIPAA’s Privacy, Breach Notification and Enforcement Rules. See, Fact Sheet 42 CFR Part 2 Final Rule | HHS.gov}