Important Compliance Deadline for Employer Sponsors of Self-Funded Health Plans: Update and Distribute HIPAA Notice of Privacy Practices by February 16, 2026
At a Glance
Employer sponsors of self-funded group health plans that are subject to the Health Insurance Portability and Accountability Act (“HIPAA”) should take immediate action to revise and redistribute their HIPAA Notice of Privacy Practices (“NPP”). For plan sponsors of fully insured group health plans, the NPP obligation is typically handled by the insurance carrier. But this NPP requirement does apply to plan sponsors of Medical Flexible Spending Accounts and Health Reimbursement Arrangements (because these are forms of self-funded group health plans). Further, this notice requirement does not apply to HIPAA “business associates,” unless the business associate is also a covered entity. The deadline to update and distribute the new NPP is February 16, 2026.
Background
The Department of Health and Human Services (“HHS”) issued final regulations with respect to the confidentiality of substance use disorder patient records on February 16, 2024. These regulations generally impose requirements on “Part 2 Programs.” The regulations were issued to align privacy protections applicable to Part 2 Programs and HIPAA covered entities as required by the Coronavirus Aid, Recovery, and Economic Security Act (the “CARES Act”). In part, these regulations require Part 2 Programs to provide a “patient notice” that is similar to the NPP required under HIPAA. A Part 2 Program is a federally assisted program that provides substance use disorder treatment. Group health plans are not Part 2 Programs. But a group health plan is a HIPAA covered entity.
While the final regulations abandoned the changes to HIPAA covered entities required by the earlier issued proposed regulations (those will come in future and separate regulations), it retained the requirement for HIPAA covered entities that receive (or may receive) substance use disclosure treatment records to update their NPP.
Group health plans are likely to receive such information in the context of payment for participants who receive substance use disorder treatment at Part 2 Programs. As such, we recommend that all employer sponsors of self-funded group health plans update their plan’s NPP to address the added protections for substance use disorder patient records.
Next Steps
To prepare for the February 16, 2026 deadline, self-funded plan sponsors should review and revise their NPP to include clear language on the protection of substance use disorder records. The updated NPP should be distributed to participants in the plan by February 16, 2026.
The good news is, other than the updated NPP requirement, these regulations should not substantively impact any other area of a group health plan’s (or its plan sponsor’s) HIPAA compliance efforts.
Miller Johnson Has You Covered
Miller Johnson has prepared an updated NPP that addresses the requirements related to substance use disorder records under the new regulations. The updated notice is available here for $100. While the revised NPP was prepared to supplement the Miller Johnson HIPAA kit (which is also available for purchase here), it can be used by plan sponsors who have not adopted Miller Johnson’s HIPAA policies and procedures.
Takeaway
Self-funded plan sponsors subject to HIPAA should update and distribute their HIPAA Notice of Privacy Practices by February 16, 2026 to reflect the revised confidentiality requirements applicable to substance use disorder patient records. If you have any questions about this client alert, the final regulations, or the new NPP requirements, please contact the author of this article.