The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has posted an updated model Health Insurance Portability and Accountability Act of 1996 (HIPAA) Health Plan Notice of Privacy Practices template that self-funded group health plans have been waiting for.
As background, federal law protects the privacy of patient records related to substance use disorder (SUD). OCR explains that confidentiality protections are important because fear of discrimination or legal trouble can deter people from seeking SUD treatment. A final rule that modified the privacy notice regarding the confidentiality of SUD treatment records (known as “Part 2 records”) has been effective since April 16, 2024, and compliance was required by February 16, 2026.
Note: “Part 2” records, programs and rules are named after their location in the Code of Federal Regulations (Title 42 Part 2).
The HIPAA Privacy Rule requires health plans and covered health care providers to develop and distribute a notice that provides a clear, user friendly explanation of individuals’ rights with respect to their personal health information and the privacy practices of health plans and health care providers.
HIPAA covered health plans that create or maintain Part 2 records are required to provide a notice to individuals that includes:
- How the entity may use and disclose Part 2 records.
- The entity’s responsibilities with respect to the records.
- Individuals’ privacy rights.
New Model Notice Template
OCR developed updated model notices to reflect the latest Part 2 requirements. Self-funded group health plans may use the models by entering their specific information.
HIPAA Health Plan Notice of Privacy Practices (online version)(.docx/document version)
Model Notice Changes
Excerpts that contain “substance use disorder”
Our Uses and Disclosures … To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.
How else can we use or share your health information?
We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. And in all cases, if we have substance use disorder patient records about you, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.
Excerpts from “Other Instructions for Notice” section
Instructions for adapting the Model Notice of Privacy Practices for HIPAA Health Plan to a covered entity’s specific information include
- Insert effective date of the notice.
- Insert name or title of the privacy official, their email address and phone number.
- Insert any special notes that apply to your entity’s business such as “we do not use or share any of your information for marketing purposes.”
- The privacy rule requires you to describe any state or other laws that require greater limits on disclosures. For example, you might describe the effects of a state law by stating, “We will not share your mental health treatment billing records without your written consent unless it is for treatment or another law requires us to share the information.” Insert this type of information here. If no laws with greater limits apply to your entity, no information needs to be added.
- If your entity provides patients with access to their health information using an online portal, you may want to insert a reference to it.
- If your entity is part of an organized health care arrangement (OHCA) that has agreed to a joint notice, insert how you share information within the OHCA (such as for treatment, payment, and operations related to the OHCA). Also, describe the other entities covered by this notice and their service locations. For example, “This notice applies to Corporation Group Health Plan and Grace Health Insurance, which provides health coverage to Corporation Group Health Plan in the greater Dayton area.”
In Closing
Self-funded group health plans that have already updated their notice of privacy practices might want to compare the model notice template and note any discrepancies.
Developed by International Foundation Information Center staff. This does not constitute legal advice. Please consult your plan professionals for legal advice.
