You may have heard about some recent changes to HIPAA. Here’s what you need to know:
Substance Abuse Disorder (SUD) Records
Background: In 2024, the U.S. Department of Health and Human Services (HHS) issued a final rule to update privacy protections for substance use disorder (SUD) records created by an SUD program that is subject to 42 C.F.R. Part 2, to strengthen patient consent and redisclosure. While the rule primarily applies to SUD programs (e.g., federally assisted programs hold themselves out as providing diagnosis, treatment, or referral for treatment of a substance use disorder) that are subject to Part 2, certain changes apply to all HIPAA Covered Entities (such a dental offices), including those that are not Part 2 programs, since they may receive SUD Records from Part 2 programs for treatment and care coordination purposes.
Requirement: By February 16, 2026, all HIPAA Covered Entities must add language to their HIPAA Privacy Notices describing:
· how they may use and disclose substance use disorder records (SUD Records);
· the prohibition on using or disclosing SUD Records subject to Part 2, or testimony relaying the content of such records, in any civil, criminal, administrative, or legislative proceedings against the patient without specific written consent or a court order; and
· the right of a patient to opt out prior to receiving a communication if a Covered Entity intends to use or disclose SUD Records subject to Part 2 for fundraising for the benefit of the Covered Entity.
If your office does not intend to engage in fundraising activities, the following is sample language to add to your office’s HIPAA Privacy Notice; you should check with your legal and/or compliance counsel to confirm the appropriateness of this language as well as the impact, if any, on your office’s policies and procedures:
Special Protections for Substance Use Disorder Treatment Records
Substance Use Disorder (SUD) records are protected under 42 CFR Part 2 and HIPAA. Any SUD-related information disclosed to this dental practice will be limited to oral-health-related considerations such as medication interactions, anesthesia risk, and infection control, and may be redisclosed as permitted by HIPAA. However, such records cannot be used in legal proceedings against the patient without specific consent or a court order.
You should provide your revised HIPAA Privacy Notice to new patients as well as post it in your waiting room as well as on your website. You do not need to provide the revised Notice to existing patients unless they ask for a copy.
Reproductive Care
Background: Although HHS had amended HIPAA in 2024 to support reproductive health care privacy, that rule amendment was vacated by the U.S. District Court for the Northern District of Texas in June 2025.
Requirement: None – HIPAA Privacy Policies need not make any reference to reproductive care privacy.
HIPAA Security Rule Amendment
Background: In late 2024, HHS’s Office for Civil Rights (OCR) issued a proposed update to the HIPAA Security Rule to strengthen requirements for Covered Entities to safeguard electronic protected health information (ePHI) to protect, detect, contain, mitigate, and recover from cybersecurity threats. To date, HHS – under the Trump Administration – has not finalized the rule. However, the OCR has kept the rule’s finalization on its official regulatory agenda for May 2026, so it is possible it will be implemented this year in some form.
Requirement: No changes yet; however, dental offices should comply with the existing rule’s requirements to:
· Conduct a Risk Analysis to formally evaluate risks and vulnerabilities in their environments; and
· Conduct periodic HIPAA risk awareness training for staff.
** For more information on HIPAA requirements or to schedule a training for your office, please feel free to contact Russell at 781-471-0915 or at Russell@doc4ne.com **
Leave a Reply