New HIPAA rules address substance use disorder records

The ADA updated its sample Health Insurance Portability and Accountability Act, or HIPAA, Notice of Privacy Practices to reflect new federal requirements regarding the use and disclosure of certain substance use disorder treatment information. Beginning Feb. 16, HIPAA-covered practices must include information in their Notice of Privacy Practices describing how substance use disorder records protected under title 42 of the Code of Federal Regulations Part 2 may be used and disclosed. The new federal requirements are the result of a final rule modifying the Part 2 rules published Feb. 16, 2024. 

The updated sample Notice of Privacy Practices is intended to help dental practices meet their legal obligations while clearly communicating patients’ privacy rights.    

Under federal law, the Part 2 rules provide heightened confidentiality protections for records related to federally assisted substance use disorder diagnosis, treatment, or referral. Dental practices may receive these records as part of a patient’s health history or through coordination of care with other providers. The updated Notice of Privacy Practices explains how these records may be handled when they are received by a dental practice with consent from an individual in a Part 2 program, or under one of the exceptions to the consent requirements. 

The HIPAA Notice of Privacy Practices is not required to include information concerning reproductive health. Provisions of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy requiring such modifications was vacated by a decision of the U.S. District Court for the Northern District of Texas on June 18, 2025. 

The sample Notice of Privacy Practices makes clear that certain types of information are subject to special protections.  

“Some information, such as HIV-related information, genetic information, alcohol and/or substance use disorder treatment records, and mental health records may be entitled to special confidentiality protections under applicable state or federal law. We will abide by these special protections as they pertain to applicable cases involving these types of records,” according to the sample notice.   

A new section of the sample Notice of Privacy Practices specifically addresses substance use disorder treatment information governed by Part 2. It explains the difference between records received through a general consent from the patient and records received under a specific consent. The sample notice also states that Part 2 records generally may not be used against a patient in legal proceedings without proper authorization or a qualifying court order.  

“In no event will we use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order,” the sample notice reads.  

What does this mean for dentists?

To comply with the new requirement by the Feb. 16 deadline, dental practices should update the Notice of Privacy Practices by including the new language related to substance use disorder information disclosure language. They should provide the revised Notice of Privacy Practices to new patients at intake, have it available at the dental office for individuals to request, and post the information in a prominent location in the dental office, as well as on the dental office website if it has one, as required by HIPAA. Electronic distribution is acceptable if patients have agreed to receive notices electronically. 

The requirement to update Notice of Privacy Practices does not change other longstanding HIPAA requirements such as the provider’s duty to safeguard protected health information, obtain patient authorization for certain uses and disclosures, and notify affected individuals following a breach of unsecured protected health information. 

“Dental practices should assess whether they maintain or receive records associated with substance use disorder treatment programs, or Part 2 programs, and update applicable policies, consent forms, and Notices of Privacy Practices,” said Jennifer Thompson, D.D.S., chair of the ADA’s Council on Dental Practice. “It is also important to train clinical and administrative team members to understand the rules governing patient records under HIPAA and related confidentiality rules.” 

The updated ADA sample Notice of Privacy Practices replaces the sample Notice of Privacy Practices previously included in the ADA Practical Guide to HIPAA Compliance, the ADA Practical Guide to HIPAA Training and the Personalized Notice of Privacy Practices Brochure. E-book versions of these publications have already been updated.  

Members who wish to order updated printed copies of the brochure may do so through ADAstore.org. For more information about the HIPAA Privacy Rule for professionals, visit this webpage. For more information about the final rule, check out the online fact sheet.