Click here to view a PDF version of this client alert.

As discussed in our recent Employee Benefits Newsletter and earlier Client Alert, the Department of Health and Human Services (“HHS”) Final Rule to amend the HIPAA regulations includes changes to HIPAA Notice of Privacy Practices (“NPP”). The deadline for making those changes is less than two weeks away on February 16, 2026.

Changes to HIPAA Notice of Privacy Practices

The Final Rule revises the requirements for the NPP.  It adds new requirements to address certain substance use disorder treatment records. Additionally, the NPP must include a statement to put individuals on notice of the potential for information disclosed pursuant to the HIPAA Privacy Rule to be redisclosed by the recipient and that the information will no longer be protected by HIPAA.

Providing Individual with the Revised Notice of Privacy Practices

When the NPP is materially changed, the revised NPP or information about the changes must be provided to covered individuals.

For health plans maintaining a website (such as an enrollment website or a website with information about the plan or its benefits), the revised NPP must be posted to that website. Additionally, the revised NPP or information about the changes to the NPP and how to obtain the revised NPP must be included in the plan’s next annual mailing to covered individuals.

If a health plan does not maintain a website, the updated NPP, or its notice of availability, must be distributed to all participants within 60 days of the effective date of the change.

Important Action Items

We recommend that plan sponsors:

• Revise and distribute new HIPAA notices of privacy practices.
• Review HIPAA policies and procedures and business associate agreements to address the requirements in the Final Rule and revise as necessary.
• Provide training on the revised HIPAA policies and procedures, especially for individuals processing requests for information related to substance use disorder treatment.
• Review plan communications to ensure all HIPAA references are current to reflect these modifications.

If you have questions about HIPAA or these action items, please contact a member of Kutak Rock’s Employee Benefits Practice Group.