HHS Privacy Rule on Substance Abuse Records Comes into Effect Feb. 16
Companies should review privacy notices, staff training and compliance protocols before Feb. 16 to avoid enforcement action under new HIPAA rules related to substance use disorder records, attorneys at Polsinelli said Tuesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
All HIPAA-covered entities must update notice of privacy practices by Feb. 16 to address “certain uses and disclosures of Part 2 Records” under HIPAA, Polsinelli said. The changes relate to final rules the Department of Health and Human Services issued to strengthen patient consent, redisclosure and enforcement provisions. Violations are subject to civil penalties and enforcement action from the HHS Office for Civil Rights.
“Organizations should review and update their NPPs, policies and procedures, staff training, and compliance protocols well before the 2026 deadline,” said Polsinelli. “Proactive engagement with counsel can help ensure alignment with both HIPAA and Part 2 requirements and mitigate potential enforcement risks.”