Required Action for Certain Health Care Providers: Updates to Notice of Privacy Practices
02/26/26
Under the HIPAA Privacy Rule (the “Privacy Rule”), health care providers are required to have a notice of privacy practice (NPP) that notifies patients that they have certain rights to ensure the privacy of their personal health information (PHI) and to explain the privacy provider that maintains any substance abuse disorder (SUD) records or has SUD records flow through its systems must guarantee that its NPPs make individuals who are the subject of such records aware of their specific rights with respect to the use and disclosure of SUD records.
Accordingly, health care providers who maintain SUD records should update their NPPs to make patients with such records aware that their SUD record information can only be used or disclosed under limited circumstances including with their written consent, during medical emergencies, or if there is a court order to do so.
Further, providers who plan to use SUD records to fundraise are required to give patients a “clear and conspicuous opportunity” to opt out of their information being included in such communications. In some instances, rules surrounding SUD records are more stringent than rules for other types of PHI. Therefore, NPPs should reflect those instances of increased restrictions and additional obligations so that patients are able to understand that their SUD records are not treated in the same way as other general PHI. For example, under HIPAA, a provider can generally disclose PHI when there is a court order. However, with regard to SUD records, there must be a court order that shows good cause – meaning the need for disclosure outweighs the individual’s right to privacy of such sensitive records.
In addition to the more general guidelines, the Privacy Rule now requires that NPPs include other specific language. Further, NPPs should state that if information is properly disclosed under the Privacy Rule, the information may be re-disclosed without any further protections (meaning any more stringent or limited uses of SUD records are no longer applicable).
Providers are permitted to streamline their notice requirements into one comprehensive document that properly notifies all patients of their respective rights. Providers who have not already made the requisite updates to their documents should do so immediately to ensure continued compliance.
Members of Bodman’s Health Care Practice Group can provide guidance on this matter and other practical advice to meet your needs. To discuss these or any other legal issues affecting your organization, please contact Brandon Dalziel at (313) 393-7507 or bdalziel@bodmanlaw.com, Annalise Lekas Surnow at (313) 392-1059 or alekas@bodmanlaw.com or Grace Connolly (313)-393-7563 or gconnolly@bodmanlaw.com. Bodman cannot respond to your questions or receive information from you without first clearing potential conflicts with other clients. Thank you for your patience and understanding.