Mark Your Calendar: HIPAA Deadline on February 16

As a long-standing Health Insurance Portability and Accountability Act (HIPAA) deadline to amend the Notice of Privacy Practices draws near, health plan sponsors and health care providers will need to consider the measures they will take to comply.

Changes to the HIPAA regulations require health plans and most health care providers to amend their Notices of Privacy Practices by February 16, 2026, to address rules governing the confidentiality of certain information about care provided at a federally assisted treatment center for substance use disorders (SUD information). 

Substance Use Disorder Information. The new changes to the HIPAA Notice of Privacy Practices arise from a separate set of regulations governing the disclosure of substance use disorder information by certain federally-assisted entities (such as opioid treatment centers or residential facilities). These entities are required to obtain consent from patients prior to disclosing substance use disorder records, and these consents may include restrictions on how that information can be used. 

The HIPAA regulations now require the Notice of Privacy Practices to specifically address the use and disclosure of SUD information received pursuant to one of these patient consents. For example, the HIPAA-covered entity may not be permitted to use this information for the full range of treatment, payment, and health care operations if the patient’s consent limits the disclosure of the substance use information. Additionally, the Notice of Privacy Practices must describe applicable limits on the use and disclosure of SUD information for matters such as criminal or civil proceedings against an individual (uses and disclosures that might otherwise deter individuals from seeking treatment).

Providers must make the revised notice available to patients by the February 16, 2026, deadline. Similarly, health plan sponsors will need to post the revised Notice on the website where plan information may be found by the same deadline. If posted on time, plan sponsors may delay individualized delivery of the revised Notice until the next annual mailing to plan participants. Instead of providing the full Notice, plan sponsors could provide a description of the changes and instructions on how to obtain the full notice. For insured health plans, the insurance carrier will generally bear the responsibility for preparing and providing the Notice.

A significant question arises as to whether the revised Notice must be delivered on paper or whether it can be provided by email. The HIPAA regulations generally require an individual to agree to receive an emailed Notice, but health plans and health care providers may consider whether that requirement strictly applies to the revised Notice.

Plan sponsors and providers may also consider whether changes to other HIPAA-related documents are appropriate, including changes to their:

• Internal HIPAA privacy policies and procedures
• Business associate agreements with applicable vendors
• HIPAA training materials.

Reproductive Health Information. Until recently, substance use disorder information was not the only regulatory change driving edits to the Notice of Privacy Practices. As many covered entities are aware, regulations issued under the Biden administration put strict limits on the use and disclosure of information related to an individual’s reproductive health. However, the reproductive health regulations were recently vacated by a federal district court, which means these edits to the Notice of Privacy Practices do not appear to be necessary at this time.

Some health plan sponsors and health care providers may have already amended certain documents to account for the reproductive health information regulations. Recognizing the volatility of the issue, they have often qualified those amendments to apply only to the extent that the reproductive health regulations are actually in effect, which again would mean that no changes are needed. 

The handling of reproductive health information remains a highly sensitive and politicized topic. Much of the activity seeking such information and shielding the information from those who seek it is likely to occur at a state level. Health plan sponsors and health care providers may consider in advance how they would respond to a request for reproductive health information and continue to watch for developments in this arena.

Ballard Spahr lawyers continue to follow these and other HIPAA developments and are available to help you respond to these new rules.

Copyright © 2026 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.