[ Tuesday, February 03, 2026 ]
NoPP Changes Due February 16: You've likely seen plenty of law firms and others noting that HIPAA covered entities need to make changes to their Notices of Privacy Practices by February 16 to meet certain requirements included in HHS' 2024 changes to HIPAA. These changes stem from 2 separate rules, one relating to "reproductive rights" and one relating to substance use disorder treatment facilities governed by "Part 2" (i.e., 42 CFR Part 2).
I've previously written about the absolutely Xavier-Becerra-level stupidity of the HHS "reproductive rights" HIPAA revisions, where were summarily trashed at the hands of a tiny rural Texas medical practice in a Federal Court case known as Purl v. HHS. The "reproductive rights" rule had 2 parts, one requiring the completion of a complex certification form that would have technically been applicable to virtually every disclosure of health information, and the other requiring complex revisions to every covered entity's Notice of Privacy Practice ("NoPP" in my parlance). Both parts of that are gone.
The Part 2 HIPAA rule actually reflects some serious consideration by SAMHSA, trying to balance patient privacy and the ability of caregivers to make sure patients (particularly mental health patients) are taken care of. Part 2 is basically a super-HIPAA for records of most substance use disorder facilities. The HIPAA changes are probably ultimately unnecessary: covered entities have to revise their NoPPs to state if they have any Part 2 obligations and provide promises to abide by the applicable rules if they receive information protected by Part 2.
The vast, vast majority of covered entities are not Part 2 entities, and never ever come into contact with information that is subject to Part 2. However, unlike the proposed "reproductive rights" NoPP revisions, the Part 2 revisions can be easily done in one or two sentences, added as a new section to the "permitted uses and disclosures" section of your NoPP.
For your edification, here are a couple of examples, one for covered entities that are NOT Part 2 entities, and one for Part 2 entities.
If you are NOT a Part 2 entity, try adding this paragraph :
Substance Use Disorder Treatment
Records. The Practice is not a substance use disorder treatment
facility subject to 42 CFR Part 2, and does not generally expect to receive
substance use disorder treatment records.
However, in the event the Practice receives records from such a
facility, the Practice shall abide by any applicable requirements set forth in
42 CFR Part 2, and shall not use or disclose such records in civil, criminal,
administrative, or legislative proceedings against you except with your consent
or pursuant to a court order accompanied by a subpoena or other legal
requirement requiring us to disclose such information in such circumstances.
If you ARE a Part 2 entity, try this instead:
Substance Use Disorder Treatment
Records. The Practice is a substance use disorder treatment facility
subject to 42 CFR Part 2. The Practice
shall not use or disclose your information except in strict accordance with the
provisions of 42 CFR Part 2.
Specifically, the Practice shall not use or disclose such records in
civil, criminal, administrative, or legislative proceedings against you except
with your consent or pursuant to a court order accompanied by a subpoena or
other legal requirement requiring us to disclose such information in such circumstances. Please contact the Practice if you have any
questions regarding your rights to medical record confidentiality under 42 CFR
Part 2.
Don't forget, unless you're paying me, I'm not your lawyer, so please check with your legal counsel if this language is appropriate for you.
Jeff [10:55 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
