ALERT: HIPAA Privacy Notice – 2026 Required Updates Due February 16, 2026

The Department of Health and Human Services (“HHS”) updated the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Notice of Privacy Practices (“Notice”) requirements resulting from changes to the HIPAA Privacy Rule in 2024 that require the Notice to include information regarding Title 42 C.F.R. Part 2: Confidentiality of Substance Abuse Disorder Patient Records (frequently referred to as “Part 2”). The HIPAA rule that lists what information must be disclosed in a privacy notice has already been revised to reflect these Part 2 protections, but HHS has not yet issued sample language or updated its model notice. Therefore, you should contact counsel to review your current Notice and make the required changes by the deadline, February 16, 2026.

Fully-insured group health plans that don’t handle protected health information themselves can continue to rely on their insurer to provide the Notice, and insurers are responsible for distributing the updated version by that same date. If a plan posts its Notice online, it can share the revised version with current participants at its next annual mailing (such as during open enrollment) as long as the updated Notice is posted on the employer’s website or intranet by February 16, 2026. If the employer does not maintain a website that contains health plan information, then it must provide the revised Notice within 60 days after February 16 (i.e., by April 17). Plans must still provide the updated Notice to new enrollees after that date and to anyone who requests a copy.

Don’t forget – February 16, 2026 is a federal holiday, so employers should aim to meet this deadline by the preceding business day, February 12, 2026.

For assistance in updating your Notice or for any other tax or benefits-related questions, contact Stephanie Vogel or Matthew Whitehorn.