What’s New: HHS has released an updated Model HIPAA Notice of Privacy Practices (NPP). This update adds new required language related to Substance Use Disorder (SUD) treatment information, which is protected under special federal privacy rules known as Part 2. These rules are now being aligned with HIPAA, and all health plans must update their NPPs to reflect these changes.
Who This Applies To:
- A self-insured medical plan, including level-funded plans, FSAs, HRAs, or ICHRAs
- A self-funded dental or vision plan
- A fully insured plan where you have access to PHI (e.g., detailed claims reporting)
- Any “bolt-on” or carveout programs that aren’t fully insured, such as telemedicine, fertility benefits, or Rx carveouts
Exception: If you only offer fully insured medical/dental/vision and have no hands-on access to PHI, your insurance carrier is responsible for the NPP update.
What You May Need to Do:
- Update and replace your NPP immediately: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-health-plan/index.html
- Your detailed instructions are listed in the final section “Other Instructions for Notice.”
- Update any applicable internal HIPAA policies or procedures
- Provide brief training to staff who handle PHI
- Ensure timely distribution to all benefit-eligible individuals, including employees on leave, COBRA participants, and any alternate recipients by 60 days after the adoption date of February 16th. (April 16, 2026)
Distribution must be done via paper unless an individual has expressly agreed to electronic HIPAA delivery. This must be itemized in your electronic consent of acknowledgment specifically to qualify.
____________
Below is sample language you may use when communicating to your employees:
Subject: Updated HIPAA Privacy Notice
Good morning,
We’re reaching out to share an updated HIPAA Notice of Privacy Practices (NPP). The Department of Health and Human Services recently released new guidance requiring employers and health plan sponsors to provide an updated notice. This ensures everyone understands how their protected health information (PHI) is used, safeguarded, and what rights you have under HIPAA.
There is no action needed from you. We’re simply providing this updated notice to keep you informed and aligned with current federal requirements.
If you have any questions, please feel free to reach out to the HR team.
**Be sure to indicate if they are receiving this document via email or via paper and how it will be delivered.
COMMENTS