Skip to main content

Updating your Notice of Privacy Practices for 2026

Federal rules finalized in 2024 aligned 42 CFR Part 2 — the stricter privacy law protecting substance use disorder (SUD) treatment records — with HIPAA, with compliance required in early 2026. Privacy notices now need language covering the new protections.

Practices created after July 18, 2026 get the updated Notice of Privacy Practices (NPP) automatically in their form library — no action needed.

Practices created before then keep their existing NPP untouched. Your NPP is a legal document your clients may have already acknowledged, so we never edit it for you — the same reason we recommend reviewing the changes with your legal counsel before adopting them.

What changed​

The 2026 updates add language covering:

  • Notice of Part 2 rights — a statement that you provide adequate notice of clients' rights when you create or maintain records protected by 42 CFR Part 2.
  • Stricter limits on routine sharing — Part 2 records are more restricted than HIPAA's normal treatment/payment/operations permissions, and recipients' redisclosures may lose federal protection.
  • Legal-proceedings protection — Part 2 records (and testimony about them) can't be used in civil, criminal, administrative, or legislative proceedings against the client without specific written consent or a qualifying court order.
  • SUD counseling notes — a separate written authorization (not combinable with other consents, revocable) for using or disclosing SUD counseling session notes.
  • Fundraising opt-out — a clear chance to opt out before Part 2 records are ever used for fundraising.
  • Part 2 accounting of disclosures — clients may request a disclosure list specifically for their Part 2-protected records.

Our updated default also fills two gaps many older notices share: a psychotherapy notes authorization section (45 CFR § 164.501) and a proper complaints section (practice + HHS Office for Civil Rights, with non-retaliation language).

How to update yours​

  1. Go to Settings → Documents, open the Consent Forms tab, and find your Notice of Privacy Practices. If you've customized it, consider saving a copy first (open it and print/save as PDF).
  2. Edit the form and add the sections above where they fit your document — or replace the whole text with the current default language (create a client in a test practice, or contact us and we'll send you the full updated text).
  3. Save. Copies clients already signed are never changed by your edits — they keep the version they acknowledged.
  4. Re-share the updated notice with active clients (individually from the client's profile, or as part of the next intake for new clients).
info

This guide is product documentation, not legal advice — review your NPP with your legal counsel before adopting changes.