Act Now: Update and Distribute HIPAA Notice of Privacy Practices by February 16, 2026
Employer sponsors of self‑funded group health plans subject to HIPAA need to take immediate action to update and redistribute their HIPAA Notice of Privacy Practices (NPP). This requirement applies not only to major medical self‑funded plans, but also to Medical FSAs and HRAs, which are considered self‑funded health plans under HIPAA.
(Fully insured plan sponsors can typically rely on their insurance carrier to handle the NPP requirement. HIPAA business associates are not subject to this rule unless they are also covered entities.)
👉 The mandatory deadline to update and distribute the revised NPP is February 16, 2026.
Miller Johnson Can Help You Comply
Miller Johnson has created an updated, compliant NPP that incorporates the new SUD‑related requirements. It is available for purchase for $100.
Although the new notice complements the Miller Johnson HIPAA Kit, it can be used by any plan sponsor, even those who do not use our full HIPAA policies and procedures.
Background: Why This Update Matters
On February 16, 2024, the Department of Health and Human Services (HHS) issued final regulations strengthening protections for substance use disorder (SUD) patient records. Although these rules primarily target “Part 2 Programs,” the regulations also require HIPAA covered entities that receive (or may receive) SUD‑related information to update their NPPs.
Group health plans are not Part 2 Programs, but they do routinely receive SUD treatment information when processing claims. This makes the update mandatory.
Bottom line: If your self‑funded plan pays claims for substance‑use‑related treatment, and most do, you must revise your NPP to reflect the new confidentiality standards.
What You Need To Do Now
To comply with the February 16, 2026 deadline, self‑funded plan sponsors should:
- Review and revise their existing NPP – The update must clearly describe the enhanced privacy protections for SUD treatment records.
- Distribute the updated NPP – Ensure delivery to all plan participants no later than February 16, 2026.
The good news: Beyond the updated NPP requirement, the new regulations should not materially affect other areas of your HIPAA compliance framework.
Miller Johnson Can Help You Comply
Miller Johnson has created an updated, compliant NPP that incorporates the new SUD‑related requirements. It is available for purchase for $100.
Although the new notice complements the Miller Johnson HIPAA Kit, it can be used by any plan sponsor, even those who do not use our full HIPAA policies and procedures.
Takeaway
If you sponsor a self‑funded group health plan, you must:
✔️ Update your HIPAA Notice of Privacy Practices
✔️ Distribute the updated version by February 16, 2026
This is a firm compliance deadline. Acting now will ensure your plan remains fully protected and avoids unnecessary risks.
Questions
If you have questions about the rule, the final regulations, or the updated NPP, please contact the author of this alert, or an attorney in our Employee Benefits and Executive Compensation practice group.