Last reviewed October 2026

Did health plans have to update their HIPAA notice of privacy practices in 2026, and what changed?

Short answer: Yes. Plans that maintain their own notice had to add the 2024 changes, mainly statements about substance use disorder treatment records, by February 16, 2026. The reproductive health paragraphs added in 2024 were vacated by a court in 2025 and are not required.

Two 2024 rules changed the notice requirements at 45 CFR 164.520. HHS has stated that a federal court vacated the reproductive-health notice provisions (paragraphs (b)(1)(ii)(F), (G) and (H)) on June 18, 2025, but the remaining notice modifications stayed in effect, with compliance required by February 16, 2026. Those remaining changes relate chiefly to substance use disorder treatment records.

Who has to act: a self-funded or level-funded plan, and a fully insured plan whose employer receives PHI beyond summary and enrollment data. A hands-off fully insured plan relies on the carrier’s notice.

A plan that posts its notice on a website must post a material change by its effective date and cover it in the next annual mailing. Every health plan must also tell covered people at least once every three years that the notice is available and how to get it. Keep each version for six years.

Sources

Topic: HIPAA