Updated Notice of Privacy Practice – Compliance Deadline in Early 2026
By February 16, 2026, all HIPAA Covered Entities, including all employer-sponsored group health plans, must adopt an updated Notice of Privacy Practices.
The Office for Civil Rights published a final rule updating various provisions of the HIPAA Privacy Rule in 2024. While much of the rule was vacated by a court this past summer, certain updated provisions remain in place. Included in those provisions is the requirement to update the Notice of Privacy Practices to include certain information on substance use disorder records and the potential for redisclosures of records disclosed pursuant to the Notice.
Employers utilizing a third party to develop and distribute their group health plan’s Notice should verify that the third party will meet the compliance deadline. Employers who develop their plan’s Notice internally and who have not updated the Notice have until February 16th to comply.
