You have roughly nine weeks. The compliance date for the Notice of Privacy Practices changes required by the 42 CFR Part 2 alignment rule is February 16, 2026, and if your practice receives substance use disorder treatment records covered by Part 2 — from a referring behavioral health program, an affiliated addiction medicine clinic, or a health information exchange that carries them — your HIPAA notice of privacy practices has to reflect that before the date passes.

This article is for the person who owns that task: the privacy officer, the practice administrator, the compliance lead who will have to produce the revised notice, the posting evidence, and the acknowledgment log if OCR ever asks. It covers required content, distribution mechanics, retention, and a workable sequence for the next sixty days.

What a HIPAA Notice of Privacy Practices Must Contain

Under 45 CFR 164.520, a compliant notice must include all of the following:

  • The exact header language required by the rule, in plain sight: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
  • A description, with at least one example, of uses and disclosures for treatment, payment, and health care operations.
  • A description of other uses and disclosures permitted or required without authorization — public health reporting, health oversight, law enforcement, judicial proceedings, workers' compensation, and the rest.
  • A statement that any other use or disclosure requires written authorization, and that the individual may revoke that authorization.
  • Separate statements, when applicable, covering appointment reminders, treatment alternatives, fundraising communications and the right to opt out, psychotherapy notes, marketing, and the sale of PHI.
  • The individual's rights: access and copies, amendment, accounting of disclosures, requesting restrictions, confidential communications, the right to restrict disclosure to a health plan when the patient pays out of pocket in full, breach notification, and a paper copy of the notice on request.
  • Your legal duties, including the statement that you are required by law to maintain the privacy of PHI and to abide by the terms of the notice currently in effect.
  • How to complain — to you and to the HHS Secretary — with an assurance of no retaliation.
  • A named contact or office and a telephone number.
  • An effective date.

HHS publishes model Notices of Privacy Practices in several formats. They are a reasonable starting skeleton, but they are not a finished document — the model does not know your state law, your fundraising program, or whether you handle Part 2 records.

The February 16, 2026 Part 2 Deadline and Who It Actually Hits

The Part 2 final rule published in February 2024 aligned confidentiality protections for substance use disorder treatment records with HIPAA, and it carried a two-year runway. February 16, 2026 is the end of that runway.

The practical trigger is narrow but easy to miss: it applies to covered entities that receive or maintain Part 2 records. Ask three questions before you decide you're out of scope.

  1. Does any affiliated program in your organization meet the definition of a Part 2 program — a federally assisted program holding itself out as providing SUD diagnosis, treatment, or referral?
  2. Do you receive records from such a program by referral, consultation, or care coordination?
  3. Does your HIE, care coordination platform, or health plan feed push Part 2 records into your chart?

If any answer is yes, your notice needs additional content. The Part 2 requirements center on redisclosure limits, the prohibition on using Part 2 records in civil, criminal, administrative, or legislative proceedings against the patient absent patient consent or a court order, and how a patient complains about a Part 2 violation. Entities that hold Part 2 records may use a single combined notice rather than maintaining two documents; most practices should.

What Happened to the Reproductive Health Notice Changes

Do not spend December rewriting your notice around the 2024 reproductive health care privacy rule. In June 2025, a federal district court in Texas vacated the bulk of that rule nationwide, including its attestation requirement and its reproductive-health-specific notice content. The Part 2–driven notice obligations were not part of that vacatur and remain on the books.

If you already pushed a reproductive-health notice update in late 2024, you are not out of compliance — you're distributing a notice that promises more protection than the rule now requires, and you are bound by the terms of the notice you publish. Decide deliberately whether to keep that language or strip it, document the decision, and move on. Track the current text through the HHS Privacy Rule regulation page rather than secondhand summaries.

Distribution: Who Hands It Out, When, and What Gets Signed

Direct Treatment Providers

You must provide the notice no later than the date of first service delivery, including electronic service delivery. You must make a good faith effort to obtain a written acknowledgment of receipt, and if you don't get one, you must document your effort and the reason it failed. "Patient declined to sign" written in the chart on the date of service satisfies this. A blank line in your intake packet does not.

In an emergency treatment situation, provide the notice as soon as reasonably practicable after the emergency ends, and the acknowledgment requirement doesn't apply.

You must also post the notice in a clear and prominent location in your facility where patients can reasonably be expected to read it, and have paper copies available for anyone who asks. Walk your waiting room. If the notice is behind the check-in glass at a forty-five degree angle in eight-point type, it isn't posted.

Health Plans

Health plans must provide the notice to new enrollees at enrollment and, within 60 days of a material revision, to individuals then covered. Every three years, the plan must notify enrollees that the notice is available and how to obtain it. Put that three-year reminder on a recurring calendar item with a named owner, because nobody remembers it organically.

Your Website

If you maintain a website that provides information about your services or benefits, the notice must be posted prominently on that site and available electronically through it. This is the single most common gap I see during a file review — the practice revised its notice, reprinted the intake packet, and left a 2019 PDF sitting on the site. Add "update website PDF" as a checklist line item under every notice revision, with the marketing contractor named.

Email Delivery

You may deliver the notice electronically to an individual who agrees to electronic notice, and that agreement can be withdrawn. If you deliver by email and the transmission bounces, you must provide a paper copy. Patient portals count when the patient has agreed.

Material Change vs. Cosmetic Edit — and the Trap in the Middle

A material change to the notice requires a revised notice with a new effective date, and you cannot apply the materially changed terms to PHI you created or received before the revision took effect. Adding Part 2 content is material. Adding a fundraising opt-out is material. Changing your privacy officer's phone number is not.

The trap is the middle case: you change vendors, start using a new communications platform, or begin sending appointment reminders by text, and your existing notice never described that practice. You are bound by the terms of the notice currently in effect. If the notice doesn't cover it and the Privacy Rule doesn't independently permit it, you have a problem that no amount of retroactive editing solves.

Where the Notice Meets Your Vendor Paperwork

Your notice tells patients how their information moves. Your Business Associate Agreements are what make that description true downstream. When you add Part 2 language, you are telling patients that redisclosure of those records is restricted — and that promise is only enforceable against your billing company, your transcription service, and your care coordination platform if the contract says so.

Pull your vendor inventory alongside the notice revision. For any business associate that touches Part 2 records, confirm the agreement addresses the additional restrictions and that it is signed by a person with authority. If you find a vendor operating on a handshake or an expired agreement, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon — one-time purchase, no subscription, which matters when you have four gaps to close before February.

The Documentation OCR Will Actually Ask For

Under 45 CFR 164.530(j), you retain required Privacy Rule documentation for six years from creation or from the date it was last in effect, whichever is later. For the notice, that means:

  • Every version of the notice you have issued, with effective dates, kept as a versioned set — not just the current one.
  • Signed acknowledgments of receipt, or the documented good faith effort where an acknowledgment wasn't obtained.
  • Evidence of website posting for each version — a dated screenshot or a change ticket from whoever maintains the site.
  • For health plans: proof of the three-year availability notification and of distribution after material revisions.
  • Training records showing front-desk and intake staff were briefed on the revised notice.

Notice failures rarely stand alone in enforcement. They surface as a line item in a corrective action plan after a complaint or a breach, when OCR asks for the notice in effect on the date of the incident and the practice can only produce whatever is on the website today. Complaints reach OCR directly through the HHS complaint portal, and a patient does not need a lawyer to file one.

A Sixty-Day Sequence You Can Assign Today

Week 1 — Scope. Privacy officer determines whether the practice receives Part 2 records. Document the analysis in writing either way, including the vendors and referral sources reviewed. A memo saying "we do not receive Part 2 records; here is how we confirmed it" is itself compliance evidence.

Weeks 2–3 — Draft. Revise the notice. Start from the HHS model, layer in your state law requirements, add Part 2 content if in scope, and set the effective date at February 16, 2026 or earlier. Have counsel review if your state has stricter confidentiality provisions for mental health, HIV, or genetic information.

Week 4 — Approve and version. Practice owner or governing body signs off. Save the file as a dated version and archive the prior version with its end date. Do not overwrite.

Weeks 5–6 — Distribute. Reprint intake packets. Replace the lobby posting. Update the website PDF and confirm the link resolves. Load the new version into the portal. Assign each of these to a named person with a due date.

Week 7 — Train. Fifteen minutes with front desk and intake staff: what changed, where the acknowledgment goes, what to say when a patient asks a question you can't answer ("I'll have our privacy officer call you today"). Sign the roster.

Week 8 — Verify. Pull ten charts opened after the effective date. Is the acknowledgment there or the good faith effort documented? If your hit rate is under nine of ten, the workflow is broken, not the staff.

If the notice revision surfaces broader gaps — missing policies, a risk analysis that hasn't been touched since the practice changed EHRs — automated risk analysis and policy generation will close them faster than rebuilding from templates. And if the immediate gap is vendor paperwork, build the Business Associate Agreements you're missing before February 16, so the promises in your revised notice are backed by contracts that actually say the same thing.