Do you need to update your Notice of Privacy Practices for the 2026 rules?
Short answer: probably not for the reason the ads say. Here is what actually changed, what got struck down, and what is far more likely to be wrong with your notice.
The reproductive-health NPP requirements are gone
The 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy required every covered entity to add reproductive-health language to its NPP by February 16, 2026. That requirement no longer exists: a federal court vacated the rule nationwide in Purl v. HHS (N.D. Tex., June 18, 2025), HHS let the appeal deadline pass, and the Fifth Circuit dismissed the remaining appeal in September 2025. If a generator or consultant is telling you that you must add reproductive-health attestation language to your notice in 2026, that is outdated.
One honest wrinkle: the printed regulation text at ecfr.gov has not been conformed to the court’s vacatur, so the struck language still appears in the raw CFR. Omitting it is the court-aware reading, not an oversight.
The Part 2 changes are real, but narrow
What survived Purl are the NPP amendments tied to 42 CFR Part 2, the confidentiality rules for federally assisted substance use disorder (SUD) treatment programs, with a compliance date of February 16, 2026. They bind covered entities that are Part 2 programs or that create, receive, or maintain records from one: those notices must now explain, among other things, that Part 2 records cannot be used against the patient in legal proceedings without consent or a court order.
You are affected if your practice provides SUD treatment as a federally assisted program, or routinely receives Part 2 records, for example some addiction-medicine and behavioral-health practices.
You are almost certainly not affected if you run a typical dental, chiropractic, physical therapy, or outpatient therapy practice that never touches Part 2 program records. Your NPP does not need Part 2 language, and adding boilerplate you cannot honor is worse than leaving it out.
What is actually wrong with most NPPs
When we review real notices, the failures are rarely about 2026. They are older and simpler:
- A pre-2013 template. The 2013 Omnibus Rule added required statements most old notices never picked up: breach notification, the right to restrict disclosures to your health plan when the patient pays in full out of pocket (§ 164.522(a)(1)(vi)), and authorization requirements for marketing, sale of information, and psychotherapy notes.
- Missing required categories. § 164.512 disclosure categories drop out of copied templates all the time. The two we see missing most: organ, eye, or tissue donation, and research.
- The header statement, edited. The all-caps header sentence is required word for word by § 164.520(b)(1)(i). Rewording it is a real deficiency.
- No working privacy contact. The notice must carry a name or title and a phone number for privacy questions (§ 164.520(b)(1)(vii)).
Check yours in about three minutes
Our generator builds a current notice from your practice details and shows it to you as you answer, with every section citing the regulation that requires it. Preview free; $49 unlocks the clean PDF and editable Word, and counts toward the Complete Binder.
Generate your NPPStarting from the free HHS model notice?
Legitimate move: OCR’s own model NPP is free and current. Before you adopt it, see exactly what the model gives you and what it leaves you to build, honestly compared against the $49 generator and the full binder: the free HHS model NPP, what it covers and what it doesn’t.
Sources
- 45 CFR § 164.520 (Notice of privacy practices), ecfr.gov
- Purl v. U.S. Dep’t of Health & Human Servs., No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025) (vacating the 2024 reproductive-health privacy rule nationwide, except the Part 2 NPP provisions); appeal dismissed (5th Cir. Sept. 10, 2025)
- 42 CFR Part 2 final rule, 89 FR 12472 (Feb. 16, 2024); NPP compliance date February 16, 2026
HIPAA Binder provides self-help compliance documents and educational information, not legal advice, and using this site does not create an attorney-client relationship. You are responsible for your practice's compliance. For advice specific to your situation, consult a qualified attorney. We never ask for or store any patient information (PHI).