Substance use disorder protections added to Notice of Privacy Practices

Sponsors of self-funded health plans must update their Notice of Privacy Practices (NPP) by February 16, 2026. Actual distribution to plan participants must be within 60 days of that date or April 17, 2026. The last mandatory NPP update was in 2013 under the HIPAA Omnibus Rule. To assist self-funded groups, Bukaty Companies has prepared a customizable NPP template that includes the new required language. Plan sponsors should consult with legal counsel before adopting a final notice.

What’s different?

In April 2024, the Department of Health and Human Services (HHS) issued a final rule that provides privacy protections related to the confidentiality of substance use disorder (SUD) treatment records. The rule also aligns SUD protections with HIPAA’s Privacy Rule. The updated NPPs must address the use and disclosure of SUD records, reflecting the need to mitigate the stigma and discrimination associated with SUD treatment.

NPP distribution requirements

NPPs are often included in a group’s summary plan description; however, HIPAA identifies additional circumstances in which a notice must be provided.

• A covered entity must make its notice available to any person who asks for it.
• A covered entity must prominently post and make available its notice on any website it maintains that provides information about its customer services or benefits (generally applicable to providers and insurers.)
• Provide a revised notice to individuals then covered by the plan within 60 days of a material revision.
• Notify individuals then covered by the plan of the availability of and how to obtain the notice at least once every three years.

For additional information, contact your Bukaty benefits consultant.