Group health plan sponsors should take note of the February 16, 2026 deadline to update HIPAA Notices of Privacy Practices (“NPPs”) to reflect recent privacy updates for Part 2 records.

What is an NPP and why does it impact employers and other plan sponsors?

HIPAA requires that covered entities, such as group health plans, provide notices to covered individuals describing how the covered entity uses and discloses protected health information (“PHI”).  While insurance companies typically manage the NPP requirement for those sponsoring fully insured plans, that is often not the case for self-insured plans.  Thus, employers and multiemployer boards sponsoring self-insured group health plans should be aware of the upcoming deadline. 

What changes are needed to the NPP by February 16?

In 2024, the Department of Health and Human Services (“HHS”) issued regulations (the “Final Rule”) that required covered entities to revise their NPPs to address privacy protections for Part 2 records.  By way of background, Part 2 records refer to substance abuse disorder treatment records, which are generally subject to more stringent protections than other health information covered by the HIPAA privacy rules.  At times, these differences have resulted in care coordination and information sharing difficulties; the Part 2 regulations issued over the past few years were intended to mitigate these issues in part. 

At a high level, health plans must update their NPPs by February 16 to address the following points that impact use and disclosure of Part 2 records:

• Describe any use or disclosure that is prohibited or materially limited by Part 2.
• Describe the limitations on use and disclosure of Part 2 records in legal proceedings without the individual’s written consent or a court order.
• Provide a clear and conspicuous opportunity to opt out of fundraising communications before the covered entity uses Part 2 records for fundraising purposes. (Note: This seems unlikely to apply to a group health plan.)

The notice must be written in plain language and describe permitted uses and disclosures of Part 2 records, including a description of the individuals’ rights and the covered entity’s obligations.

Do we also need to mail the NPP to all covered participants by February 16?

No.  But, health plans must post the revised NPP on the health plan’s website by that date and include the revised NPP or an explanation of how to locate the updated NPP with the plan’s next annual mailing.  If the health plan does not regularly distribute documents via mail, depending on the situation and facts at hand, it may be possible to distribute the revised NPP to participants electronically.

Can we rely on the model NPP issued by HHS?

In the past, HHS issued model NPPs that could be used by group health plans as a starting point for drafting their own notices.  However, HHS has not yet issued an updated NPP reflecting the Part 2 updates.  Given the compliance deadline of February 16, 2026, it is unlikely that HHS will release a model NPP that can be used by group health plan sponsors to meet their obligations by the compliance deadline.

Do we have to make changes to the NPP related to reproductive healthcare?

No.  By way of background, the Final Rule requiring that health plans update their NPPs to reflect Part 2 restrictions also narrowed the permitted uses and disclosures of PHI in the context of an individual seeking, obtaining, providing, or facilitating lawful reproductive health care. (For more details, visit our previous blog posts here and here.) 

This past June, however, a federal district court in Texas vacated the portions of the Final Rule that added heightened protections for reproductive health care information, as discussed in our blog post here—a decision that HHS ultimately did not appeal.  This means that if a group health plan previously updated its NPP to refer to the reproductive healthcare provisions, it should revert the NPP to reflect the current status quo.

Separate from the NPP requirement, health plans that amended their HIPAA policies and procedures to comply with the reproductive health care provisions of the Final Rule should consider removing or revising language related to the reproductive healthcare rules, given those provisions are now vacated.