Episode 605: 42 CFR Part 2, HIPAA NPPs, and the February 16 Deadline: What Actually Needs to Change

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we share what’s actually necessary when updating your Notice of Privacy Practices due to Part 2.

We discuss:

• The confusion around updating NPPs without an updated model from HHS
• A quick refresher on Part 2
• Who is considered a lawful holder under Part 2
• Next steps for updating your NPP if you are a Part 2 program or lawful holder
• Our free resource on updating your NPP before the 2/16 enforcement deadline

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

PCT Resources

• PCT Free Resource: 42 CFR Part 2 & HIPAA Notices of Privacy Practices: A Decision Guide and Sample Language for Covered Entities
  • a practical resource designed to help HIPAA-covered practices determine whether the updated 42 CFR Part 2 rules apply to them — and, if so, what belongs in their Notice of Privacy Practices. The guide includes a clear decision flow, plain-language explanations of Part 2 program vs. lawful holder obligations, and sample NPP language tailored to each category. It was created to fill the gap left by the absence of an updated HHS model NPP following the 2024 Part 2 Final Rule.

Resources

• HHS Fact Sheet on the 42 CFR Part 2 Final Rule
  • this HHS Fact Sheet summarizes the 2024 Final Rule updating 42 CFR Part 2, including new consent provisions, redisclosure alignment with HIPAA, enforcement changes, and the February 16, 2026 compliance deadline. It provides high-level regulatory context for healthcare organizations handling substance use disorder records.
• JD Supra Article: 42 CFR Part 2 and Privacy Rule Compliance: Action Required by February 16, 2026
  • This JD Supra article from Snell & Wilmer outlines the compliance steps healthcare organizations must take in response to the 2024 Final Rule updating 42 CFR Part 2. It explains which entities are required to update their Notices of Privacy Practices by February 16, 2026, including both Part 2 programs and HIPAA-covered entities that receive or maintain Part 2-protected records. The article highlights required NPP updates, enforcement risks, and the importance of aligning privacy notices with the amended regulations.