The HIPAA Privacy Rule underwent significant updates in 2024, reshaping how covered entities, including dental practices, must handle sensitive patient information. These changes were designed to strengthen privacy protections around reproductive health information and align HIPAA with the updated 42 CFR Part 2 rules governing Substance Use Disorder (SUD) records. However, a major federal court ruling in Texas altered part of the regulatory landscape, leaving some provisions intact and others vacated. With a firm compliance deadline of February 16, 2026, dental practices must understand what remains in effect and what actions they must take to update their Notice of Privacy Practices (NPP) and internal workflows.
The 2024 Privacy Rule Updates: What Was Originally Required
In April 2024, HHS issued a Final Rule modifying the HIPAA Privacy Rule to enhance privacy protections for reproductive health care information. The rule prohibited covered entities from using or disclosing protected health information (PHI) for investigations or legal actions related to lawful reproductive health care and required requestors to provide written attestations before PHI could be disclosed for certain purposes.
The rule also included updates to the Notice of Privacy Practices (NPP), requiring covered entities to revise their NPPs to reflect new reproductive‑health‑related restrictions and the updated SUD confidentiality provisions.
The Texas Court Ruling: Pregnancy‑Related Provisions Vacated
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the reproductive‑health‑related amendments to the HIPAA Privacy Rule. Specifically, the court struck down the provisions that prohibited certain disclosures related to reproductive health care and eliminated the requirement for written attestations.
However, and this is critical for dental practices, the court did not vacate the NPP modifications related to Substance Use Disorder (SUD) records. Those provisions remain fully in effect.
This means dental practices do not need to revise their NPPs to include reproductive health privacy, but they must update their NPPs for the SUD/Part 2 changes.
The SUD/Part 2 Alignment: What It Means for Dentistry
Although dental practices do not diagnose or treat Substance Use Disorders, they may receive SUD‑related information as part of a patient’s medical history. For example:
- A patient may disclose they are receiving methadone or buprenorphine treatment.
- A patient may report a history of opioid misuse relevant to prescribing decisions.
- A medical history form may include SUD‑related diagnoses or medications.
Under the updated rule, SUD information documented in a dental record becomes Part 2–protected information, meaning it is subject to heightened confidentiality requirements.
The 2024–2025 Final Rule aligned Part 2 with HIPAA in several ways, but it also preserved key protections, including:
- Restrictions on redisclosure
- Patient rights to request restrictions
- Requirements to include specific SUD language in the NPP
These SUD‑related NPP requirements remain enforceable despite the Texas ruling.
The February 16, 2026 Deadline
HHS has confirmed that compliance with the remaining NPP modifications—specifically those related to SUD/Part 2—is required by February 16, 2026.
Dental practices must update their NPPs and redistribute them to patients by this date.
What Dental Practices Must Do Now
There are four key things you must do by the February 16th deadline. They are:
- Update the Notice of Privacy Practices (NPP)
Your revised NPP must include:
- A description of how the practice may use or disclose SUD treatment information
- The circumstances under which SUD information may be disclosed without authorization
- The prohibition on redisclosure
- Patient rights related to SUD information
These updates belong in the section describing uses and disclosures permitted without authorization, not in the patient rights section—though cross‑referencing is optional.
- Redistribute the Updated NPP
HHS requires covered entities to:
- Provide the updated NPP to all new patients beginning February 16, 2026
- Make the updated NPP available to existing patients
- Post the updated NPP prominently in the office and on the practice website
While dental practices are not required to mail the updated NPP to all existing patients, they must ensure it is readily accessible and provided upon request.
- Train Staff on SUD Confidentiality
Because dental teams may encounter SUD‑related disclosures during medical history reviews, staff must understand:
- What qualifies as SUD information
- When authorization is required
- How redisclosure restrictions work
- How to respond to law enforcement or third‑party requests
- Update Policies, Forms, and Workflows
This includes:
- Medical history forms to include whether the patient has a history of substance abuse or if they are in recovery.
- Authorization forms consider updating your Records Release form to include an option for the patient to authorize or decline the release of SUD-related information.
- Privacy policies stating how the practice will handle SUD-related information, what to document in the chart and redisclosure restrictions.
- Release‑of‑information procedures—verify whether the patient authorized release of the SUD information.
Why This Matters for Dentistry
Even though dental practices do not provide SUD treatment, they do maintain medical records that may contain SUD‑related information. Once documented, that information becomes protected under Part 2 and must be handled accordingly.
The February 16, 2026 deadline is firm, and OCR has made clear that the SUD‑related NPP requirements remain enforceable despite the Texas ruling.