HIPAA Notice of Privacy Practices Updates Required Feb. 16, 2026

Summary - By Feb. 16, 2026, all HIPAA Covered Entities are required to update their Notices of Privacy Practices to incorporate new disclosures concerning Substance Use Disorder treatment information and redisclosure risks. The changes apply broadly to providers and health plans and offer an opportunity to reassess overall HIPAA compliance.

It’s HIPAA Notice of Privacy Practices (NPP) update time!  Specifically, no later than Feb. 16, 2026, NPPs must be updated to include information about Substance Use Disorder (SUD) treatment information and redisclosure risks of all disclosures.

As always when there is a HIPAA regulatory revision, Covered Entities (and Business Associates) can use it as an opportunity to review HIPAA compliance overall. Indeed, experience has repeatedly revealed that many HIPAA compliance plans have not been reviewed or updated since the last required updates in 2013. As the Office for Civil Rights (OCR) has repeatedly confirmed in its various enforcement actions, HIPAA compliance requires on-going diligence.   

The most recent revisions to the HIPAA regulations (89 Fed. Reg. 33064, April 26, 2024) apply to ALL HIPAA Covered Entities.

• For Healthcare Providers, this means updating NPPs available to patients at the time of treatment and updating the NPP that is “prominently” posted on its website. New NPP acknowledgements are not needed for existing patients.
• For Health Plans, this means updating the plan website NPP and sending notice about the change in the next annual communication to plan members (or notice within 60 days for any plan that doesn’t maintain a website).

Fortunately, because HIPAA requires that NPPs be “written in plain language,” there is broad flexibility to foster readability. For specific recommended language for your organization, please contact us.

Importantly, although OCR maintains guidance and a sample NPP, it has been silent about the new requirements and has yet to update the sample to reflect the new requirements. Perhaps it will do so after Feb. 16, 2026.

Of note, the original scope of revisions to NPPs included certain reproductive health information, but those requirements have been stayed by a federal court. We will provide appropriate updates as this item unfolds.

Williams Mullen's Health Care Section has extensive experience with HIPAA compliance for all types of entities and provides advice to clients regarding policies and procedures, business associate agreement negotiations, and breach response.