In this Alert, we address the soon approaching deadline for HIPAA Covered Entities—including group health plans to update the HIPAA Notice of Privacy Practices (NPP) to include information regarding the use, disclosure, and protection of certain substance use disorder treatment records. This Alert provides a quick refresher on some HIPAA basics and identifies the actions employer-plan sponsors must take to comply by February 16, 2026. In addition, we provide a sample updated NPP for clients’ use with review and consent of their legal advisor. HHS has not issued a revised model NPP for use, as of the date of this publication.
This Alert is relevant for all employers, but it is most relevant for employers sponsoring self-insured group health plans.
