In our previous article, we explored the major 2024 HIPAA Privacy Rule updates, the Texas court ruling, and the February 16, 2026 compliance deadline. One area that deserves deeper attention is how these changes affect the Notice of Privacy Practices (NPP) and the way practices communicate privacy rights to patients. Because the SUD/Part 2 updates remain fully enforceable, dental offices must revise, repost, and redistribute their NPPs to ensure patients understand how their sensitive information is protected. This follow‑up article focuses exclusively on those requirements and what dental teams must do to stay compliant.
Updating and Redistributing Your NPP
The 2024 HIPAA Privacy Rule updates introduced new requirements for how covered entities must handle Substance Use Disorder (SUD) information under the revised 42 CFR Part 2 regulations. While the Texas federal court vacated the reproductive‑health‑related portions of the rule, the SUD‑related NPP requirements remain fully intact. This means dental practices must update their Notice of Privacy Practices (NPP) and ensure it is properly distributed to both new and existing patients by February 16, 2026.
Below is a detailed breakdown of what dental practices must do to comply.
- Update the Posted NPP in the Office
Every dental practice is required to display its NPP in a prominent location where patients can easily see it—typically the reception area. With the new SUD/Part 2 requirements, practices must:
- Replace the old NPP with the updated version
- Ensure the posted NPP includes the new federally required SUD language
- Confirm that the posted version matches the one provided to patients
This is not optional. OCR expects the posted NPP to reflect the current law, and outdated versions can be cited during audits or investigations.
- Update the NPP on the Practice Website
If your dental practice maintains a website the updated NPP must also be posted online in a prominent location, not buried in the footer. This ensures that patients can access the most current privacy information at any time.
Best practices include:
- Posting the updated NPP as a downloadable PDF
- Adding a brief note or banner indicating the NPP has been updated
- Ensuring the online version matches the in‑office version exactly
Because many patients complete forms online before their appointment, the website version is often the first NPP they encounter.
- Provide the Updated NPP to All New Patients Beginning February 16, 2026
Starting on the compliance date, every new patient must receive the updated NPP. This can be done:
- As part of the new‑patient packet
- Through electronic forms
- Via a link to the NPP on your website
- As a printed copy at check‑in
Dental practices are not required to obtain a signature acknowledging receipt, but many choose to do so as a best practice.
- Make the Updated NPP Available to Existing Patients
HIPAA does not require dental practices to mail or email the updated NPP to all existing patients. However, practices must:
- Make the updated NPP available upon request
- Provide it at the next point of service if a patient asks
- Ensure staff know how to access and distribute the updated version
OCR’s expectation is that existing patients have reasonable access to the updated NPP without being forced to request it.
- Train Staff on the Updated NPP and SUD Requirements
Because dental teams routinely review medical histories, they may encounter SUD‑related disclosures such as:
- “I’m in treatment for opioid use disorder.”
- “I’m taking buprenorphine.”
- “I’m in recovery.”
Once documented, this information becomes Part 2–protected.
Staff must understand:
- How SUD information must be handled
- When authorization is required
- What redisclosure restrictions apply
- How to respond to patient questions
Training should be documented as part of your HIPAA compliance program.
- Ensure All Forms and Workflows Align with the Updated NPP
The NPP is the public‑facing document, but your internal processes must match what you promise patients. This includes:
- Medical history forms
- Authorization forms
- Release‑of‑information workflows
- Privacy policies
- Staff scripts for responding to patient questions
If the NPP says you protect SUD information in a certain way, your practice is obligated to follow through.
Final Thoughts
The February 16, 2026 deadline is approaching quickly, and dental practices must take action now to ensure their NPPs reflect the updated SUD/Part 2 requirements. While the Texas ruling removed the reproductive‑health‑related obligations, the SUD‑related updates remain fully enforceable—and they apply to dentistry more often than many practices realize.