Compliance Stuff

Entities covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), such as group health plans, that receive or maintain substance use disorder (SUD) treatment records from programs subject to federal requirements must ensure that their Notice of Privacy Practices (NPP) complies with new regulations by  February 16, 2026 . Employers that sponsor self-funded group health plans should review their current NPP and make necessary changes to maintain compliance ahead of this important compliance deadline. What Is Changing in NPPs? In 2024, the  Department of Health and Human Services (HHS) issued a final rule  modifying the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) under HIPAA. The Privacy Rule requires HIPAA-covered entities to update their NPP to reflect new requirements for protecting SUD records, as mandated by Congress in the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020. SUD records...

Takeaways Even though we have the promise of a non-enforcement policy applying to the 2025 and 2026 deadlines of at least some provisions of the 2024 Final Regulations, the  2013 Final Regulations , the Consolidated Appropriations Act, 2021, and other MHPAEA requirements remain enforceable.  Related Links Final regulations issued in September 2024 ERISA Industry Committee challenge to the final regulations Motion for Abeyance by the Departments 2013 MHPAEA Rule Article The Department of Labor (DOL), together with the Departments of Treasury and Health and Human Services) have decided to suspend enforcement of certain provisions of the nonquantitative treatment limitations (NQTL)  final regulations issued in September 2024 .   Those regulations had been challenged in  federal court  by the ERISA Industry Committee (ERIC) last year, and the Departments’ answer to ERIC’s complaint was due May 12, 2025.  In a  motion filed   May 9, 2025, the Depa...