The Department of Health and Human Services (HHS) recently released its model HIPAA Notices of Privacy Practices (NPPs), updated to reflect the rules regarding substance use disorder (SUD) treatment record protections.
Group health plans can access a model notice as well as a Word version of a model notice on the HHS website. Under the HIPAA privacy rules, group health plans and other covered entities that receive, maintain or transmit certain SUD treatment records must update their NPPs to include specific content related to how they use or disclose the records. The deadline for updating the NPP was February 16, 2026.
The HHS Office for Civil Rights (OCR) also announced a civil enforcement program to implement and enforce statutory and regulatory requirements that protect SUD treatment record confidentiality. As of February 16, 2026, OCR is accepting complaints alleging violations of the rules protecting SUD treatment records as well as notifications of breaches involving SUD treatment records. Penalties for noncompliance are aligned with those that apply under the HIPAA privacy and security rules, which can include civil money penalties. Information about the SUD record confidentiality requirements, including how to file a complaint or a breach report, is available on the HHS website.
Employer group health plan sponsors that may receive SUD treatment records but have not updated their NPPs to meet the requirements should do so as soon as possible in consultation with legal counsel.
