NPP Update Builder
Generate sample NPP clause language for the February 16, 2026 Part 2/SUD (42 CFR Part 2) alignment deadline. Answer 5 questions to get personalized sample clauses.
HIPAA and 42 CFR Part 2 alignment deadline
The final rule takes effect on February 16, 2026. Covered entities should update their Notice of Privacy Practices before this date.
Why Update Your Notice of Privacy Practices?
The February 16, 2026 deadline marks a significant change in how healthcare providers must handle substance use disorder (SUD) treatment records. The final rule, issued February 8, 2024, aligns 42 CFR Part 2 protections with HIPAA, simplifying compliance while maintaining and expanding important patient protections.
This tool helps you generate sample language for your Notice of Privacy Practices (NPP) to address these changes. The output is educational and should be reviewed by your compliance team or legal counsel before implementation.
Key changes taking effect:
- SUD records can now be used for treatment, payment, and healthcare operations under a single general consent (previously required separate consent for each disclosure)
- Legal proceedings protections are expanded to include civil, administrative, and legislative proceedings (previously limited to criminal proceedings)
- HIPAA Breach Notification Rule now applies to Part 2 records (new requirement)
- Redisclosure restrictions remain in place with updated notice language per 42 CFR 2.32
- OCR now enforces Part 2 compliance with HIPAA-aligned penalties
- Patient rights specific to Part 2 must be enumerated in your NPP
- Fundraising opt-out rights must be provided if you use records for fundraising
- Separate consent forms required for legal proceedings (cannot combine with TPO consent)
- State laws may provide additional protections that still apply alongside Part 2
What's Changing in February 2026?
The HIPAA Privacy Rule modifications require significant updates to how you handle substance use disorder (SUD) records.
Separate 42 CFR Part 2 rules
SUD records required separate consent forms and handling
Complex dual compliance
Providers juggled two different regulatory frameworks
Limited patient rights clarity
NPP often didn't address SUD-specific protections
Unified HIPAA framework
Part 2 records now integrated with HIPAA Privacy Rule
Updated NPP requirements
Must include specific SUD language and patient rights
Enhanced breach protections
New notification and civil/criminal penalty provisions
Your NPP Update Process
Review Current NPP
Identify gaps in SUD coverage
Use This Tool
Generate compliant language
Legal Review
Consult compliance team
Implement & Train
Update before deadline
Build Your Sample NPP Language
Answer a few questions about your practice to generate personalized sample clauses for your Notice of Privacy Practices.
How This Tool Works
Answer 5 simple yes/no questions about your practice. Based on your answers, we'll generate relevant sample language for your NPP update.
Each section will be marked as Required or Recommended based on the regulatory requirements and your practice characteristics.
You can then:
- Copy the text to your clipboard
- Download as PDF with professional formatting
- Download as Word for easy editing
Reference Resources
HHS Final Rule: 42 CFR Part 2
HHS announcement of the final rule aligning Part 2 with HIPAA
Federal Register: Final Rule Text
The official Federal Register publication of the 2024 final rule
42 CFR 2.32 - Notice Requirements
Legal text for redisclosure notice requirements
SAMHSA Part 2 Resources
SAMHSA resources and FAQs on 42 CFR Part 2
eCFR: 42 CFR Part 2
The official Code of Federal Regulations text
HHS HIPAA Resources
General HIPAA information from HHS
Frequently Asked Questions
Common questions about the February 2026 deadline and NPP updates.
Stay Updated on Compliance Changes
Get notified about important healthcare compliance deadlines and new tools.