HIPPA Notice of Privacy Practice Update
Deadline: February 16, 2026
No later than February 16, 2026, employers that create / maintain Substance Use Disorder (SUD) records must update their Notice of Privacy Practices (NPP) to include stricter protections for Substance Use Disorder records. The Notice of Privacy Practices must explain:
-
-
Rights concerning substance use disorder records, which are stricter than other health information confidently rules.
-
Limits on use of SUD records—records are not typically used / released for court proceedings unless written notice is received by member.
-
Impact of other laws—employers must clearly indicate that certain uses and disclosures permitted under HIPAA do not apply to SUD records.
-
Fundraising—if employers use or disclose SUD records for fundraising purposes, it must be noted on the Notice of Privacy Practices.
Prior to the deadline, employers should:
-
-
Establish if the company creates or maintains SUD records.
-
Revise the Notice of Privacy Practices to align with new regulations.
-
Ensure current language aligns with current regulations.
-
Confirm delivery methods comply with federal regulations.
The Notice of Privacy Practices is a longstanding HIPAA requirement that informs employees how their personal health information (PHI) may be used, shared, and protected by providers and plans, and outlines their privacy rights for accessing their records and filing complaints. Employers are responsible for creating and distributing the Notice of Privacy Practices. The Fact Sheet 42 CFR Part 2 Final Rule can be reviewed here.
Notice of Availability for Forms 1095-B & 1095-C Update
Deadline: March 2, 2026
Employers can now post Notice of Availability for Forms 1095-B and 1095-C on their company’s website instead of distributing the Notice to each employee, but specific rules must be followed:
-
-
The Notice of Availability must be noticeable and clear, located on the company’s website, and in a place that is easily accessible.
-
Must use a LARGE FONT SIZE to call attention to the information.
-
Notice of Availability should include:
-
-
Statement that the individual may obtain a paper copy of the forms upon request.
-
Email or physical address to which a request for a paper statement can be sent.
-
Telephone number that the individual can use for questions.
If an employer chooses to electronically publish the Notice of Availability instead of mailing hard copies, compliant notices must be posted by March 2, 2026, regarding 2025 coverage. The posting must remain on the employer’s website until October 15, 2026.
Employers must continue to file ACA forms to the IRS by March 2, 2026.
