On March 27, 2020, Congress enacted the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Perhaps one of its lesser-known features, the CARES Act included a provision related to the confidentiality and disclosure of substance use disorder (SUD) patient records. These statutory changes in the CARES Act also required the United States Department of Health & Human Services (the DHHS) to revise its administrative regulations that pertained to SUD patient records (i.e., 42 CFR part 2, or “part 2”) to align those regulations more closely with the privacy protections in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). On February 16, 2025, the DHHS issued a final rule implementing these changes.
These changes require all HIPAA covered entities that create, receive, maintain, or transmit SUD patient records to update their Notices of Privacy Practices (NPPs) by February 16, 2026, in order to advise patients how their SUD records are protected and how the records may be used or disclosed. Among other things, a revised NPP must adequately provide patients with notice of their rights and of the HIPAA covered entity’s legal obligations with respect to those records as well.
The DHHS also recently revised its Model Notice Templates to help HIPAA covered entities comply with these new requirements, which can be located online.[1] Importantly, these new notice obligations are not strictly limited to health care providers who offer substance use treatment. Rather, other health care providers, health care plans, employers, or other covered entities may also be required to meet these updated notice requirements if they generate or receive SUD patient records as part of their business operations. Entities that are required to meet these obligations and which fail to do so may be subject to fines and other penalties.
If you have any questions about whether your organization is subject to these updated requirements, or if you need assistance in reviewing or revising your NPP, please do not hesitate to contact one of our attorneys.
[1] See U.S. Department of Health and Human Services, Model Notices of Privacy Practices (March 26, 2026), https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html
Davenport Evans Lawyers are ready to assist clients with employment law matters. To connect with our team, call 605-336-2880, email [email protected], or find a specific lawyer here.
Davenport, Evans, Hurwitz & Smith, LLP, located in Sioux Falls, South Dakota, is one of the state’s largest law firms. The firm’s attorneys provide business and litigation counsel to individuals and corporate clients in a variety of practice areas. For more information about Davenport Evans, visit www.dehs.com.