Compliance Stuff

If your business is required to maintain a notice of your HIPAA privacy practices, you must act quickly to make sure your notice is updated to comply with new requirements established in a 2024 final rule. Specifically, you have until  February 16  to revise your NPP to include specific content related to heightened confidentiality rules for substance use disorder treatment records. We’ll explain everything you need to know ahead of the impending deadline. Quick Background HIPAA Privacy Rule.  Federal regulations (known as the “Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) set national standards for safeguarding individuals’ “protected health information” (PHI), such as their medical records and other individually identifiable health information. These rules apply to “ covered entities ” – such as health plans or healthcare providers – and their “ business associates .” Privacy Notice Requirement.  Unless an exception ...

Entities covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), such as group health plans, that receive or maintain substance use disorder (SUD) treatment records from programs subject to federal requirements must ensure that their Notice of Privacy Practices (NPP) complies with new regulations by  February 16, 2026 . Employers that sponsor self-funded group health plans should review their current NPP and make necessary changes to maintain compliance ahead of this important compliance deadline. What Is Changing in NPPs? In 2024, the  Department of Health and Human Services (HHS) issued a final rule  modifying the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) under HIPAA. The Privacy Rule requires HIPAA-covered entities to update their NPP to reflect new requirements for protecting SUD records, as mandated by Congress in the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020. SUD records...