Evan Dumas 

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co-host, Evan Dumas.

 

Liath Dalton 

And I’m Liath Dalton, and we are Person Centered Tech.

 

Liath Dalton 

This episode is brought to you by Therapy Notes. Therapy Notes is a robust online practice management and electronic health record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system with all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new Therapy Notes user go to therapynotes.com and use promo code PCT.

 

Evan Dumas 

Hello and welcome to Episode 609: Update: HHS Releases Model NPP for Part 2 Changes–What It Means for Your Practice.

 

Liath Dalton 

Indeed. So a little context and background here in our recent episode, number 605, we talked about the February 16 enforcement deadline for the Part 2 Final Rule, and the changes that some practices needed to make to their Notice of Privacy Practices. However, at the time that we recorded that episode, and actually the reason that we recorded that episode, was because HHS had not yet released an updated model Notice of Privacy Practices, which historically is the template that we look to for guidance and kind of uses the gold standard for what the Notice of Privacy Practices should contain.

 

Liath Dalton 

So now fast forward to the time of recording this episode in early March of 2026 and HHS has now quietly, I might add, released both an updated model Notice of Privacy Practices and a model Part 2 Patient Notice. So since these are now available, we wanted to do a quick follow up to walk through what actually changed and what it means for your practice. Like, do you need to do anything different now if you already made some changes ahead of or in line with that February 16 deadline?

 

Liath Dalton 

So basically, we’re just going to cover what was released, what changed, and then how that relates to the resource that we created and shared in that previous episode, 605, which was the decision guide and sample language.

 

Liath Dalton 

So a little refresher on what the Final Rule from 2024 for Part 2 is and what the changes were, basically that rule just aligned some aspects of Part 2 with HIPAA, including a single consent for treatment payment and health care operations, or TPO redisclosure alignment with HIPAA, and then that the Office of Civil Rights, the OCR, is the enforcement authority. Importantly, Part 2 does remain more protective than HIPAA, especially around disclosures without consent in regards to legal proceedings and providing protections for substance use disorder treatment records.

 

Liath Dalton 

Now, Evan, why was that February 16 deadline so confusing for folks?

 

Evan Dumas 

Yeah, because, one, they didn’t have a model for people as to what to do. They just said you gotta do something, and everyone was kind of left to their own to try to interpret these, like, requirements. You’re getting articles saying, quick, everyone do something. And it wasn’t everyone, but they didn’t really give you a decision tree or anything like that to tell you what you needed to do.

 

Liath Dalton 

Right.

 

Liath Dalton 

Because there is this very important category of folks who do need to make some changes, but that those changes don’t include the full patient notice and the pieces that are applicable to Part 2 programs, which is a very specific category. And it’s really important that if folks are neither a lawful holder or a Part 2 program, that they don’t start adding Part 2 program language to their NPP or providing client notices that contain that.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

So we’re going to talk through that in a bit more detail momentarily. Basically what has now been released were, quietly appeared on the HHS website as of February 20, so four days after the enforcement deadline, and when we say quietly, we mean that there was no email notification to the Privacy Rule or Security Rule listservs.

 

Evan Dumas 

Yeah, they have a newsletter for this even, yeah.

 

Liath Dalton 

Yeah!

 

Liath Dalton 

So it’s really odd that nothing about this went went out, nor has it since then. But anyway, they have now released an updated model Notice of Privacy Practices, and then also provided a model Part 2 Patient Notice. So these two documents work together, but serve different purposes.

 

Liath Dalton 

And the important part about why there are two distinct notices, it’s to really clarify the regulatory structure, and because there are two different notice requirements, the HIPAA Notice of Privacy Practices is required under HIPAA, specifically under the Privacy Rule, and that explains how providers use and disclose Protected Health Information. Generally, it’s basically informing patients, slash clients, of their rights under HIPAA, rights and protections under HIPAA.

 

Liath Dalton 

Then, the Part Two Patient Notice is what is required under 42 CFR Part 2 for Substance Use Disorder treatment programs.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Emphasis on programs, and that notice explains the specific confidentiality protections that apply to Part 2 records. So essentially, the new model documents handle this by the updated HIPAA NPP alerting patients that some records may be protected by Part 2 and notes that those records have additional confidentiality protections. The detailed explanation of those protections, though, is all what is contained in the separate Part 2 Patient Notice.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

Essentially, then the structure is that the NPP creates the awareness of Part 2 protections, and then the Part 2 notice itself is the detailed explanation.

 

Liath Dalton 

Now you might be thinking, Oh, my goodness, the HIPAA NPP contains a lot of content, and it’s very important, how substantial are these changes? And you know, if I’m having legal counsel review these changes and make updates, how time consuming and expensive is this going to be? Great news. Changes to the actual HIPAA NPP are really modest. There are just a few lines in fact that are now included in the update, and that specifically are additions that some health information may be protected by 42 CFR Part 2, that those records may have additional confidentiality protections beyond HIPAA, that some disclosures, particularly legal proceedings, may be restricted and that additional patient rights may apply.

 

Liath Dalton 

The rest of the NPP didn’t change, so it’s really just a few lines in a couple sections. And again, that’s just adding awareness about Part 2, rather than embedding the full rule in the HIPAA NPP.

 

Liath Dalton 

So this is the area where a lot of therapists and mental health practices get some confusion, and that is in the area of when an individual or a practice is a lawful holder.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Because it’s important to understand here that Part 2 rules don’t only apply to Substance Use Disorder treatment programs, they also can apply to what are referred to as lawful holders, which means, if your practice receives records from a Part 2 program, like from a Release of Information, and you maintain those records, the confidentiality protections travel with them.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

So even if you’re not a Part 2 program yourself, those specific records may still be subject to Part 2 protections.

 

Evan Dumas 

Yeah, yeah, definitely.

 

Liath Dalton 

And this is really why we put together that decision tree guide that was a resource that we provided along with episode 605, because we were seeing that whether or not a provider or practice qualified as a lawful holder was an area of confusion.

 

Evan Dumas 

Oh yeah.

 

Liath Dalton 

And it’s important to note that if you are not a Part 2 program or a lawful holder, you should not be adding Part 2 language,

 

Evan Dumas 

No.

 

Liath Dalton 

to your Notice of Privacy Practices or to, through the provision of that additional Part 2 notice.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

So we really wanted to help resolve that lack of clarity and help folks know if something applied to them and if so what.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

So now that we’ve talked about all of that and the the new model documents from HHS are available, the natural question is, should you switch to the HHS model?

 

Evan Dumas 

Yeah.

 

Liath Dalton 

And the answer is, you don’t need to.

 

Liath Dalton 

It is not a required template. It is optional guidance, so you don’t have to replace your NPP simply because the model was released. What should folks do instead, Evan?

 

Evan Dumas 

Nope.

 

Evan Dumas 

They should, you know, first find out even if it applies. Like, go through that decision tree before you start wondering, Oh, should I adopt this model? Should I talk to an attorney? And then, if it does apply, then make sure your NPP has the appropriate language, either from our form or from the model one. And then, you know, use the model as a reference point. Just like, take a gander at it. See what you need to add. And don’t replace yours, like whole, just tweak it a little bit.

 

Liath Dalton 

Exactly.

 

Liath Dalton 

And now another related and important question is, if your practice used the decision guide and sample language that we shared prior to the February 16 deadline to update your NPP, this is not something that would create compliance gaps.

 

Evan Dumas 

No.

 

Liath Dalton 

Importantly, the language that we provided reflected the same key concepts that are in the updated model notice from HHS.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

So the same notices and provisions including identifying some records being potentially protected by Part 2, explaining that those records have additional confidentiality protections, and referencing restrictions around redisclosure and legal proceedings.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

The one important caveat here is that if your organization is an actual Part 2 program, so a formal Substance Use Disorder treatment program, then you do need to ensure you are providing the Part 2 Patient Notice. So that’s an additional layer above and beyond the Part 2 references and additions to the model Notice of Privacy Practices.

 

Liath Dalton 

We did not focus episode 605 on notice contents, because the vast majority of the folks that we work with and that are listeners to this podcast do not fall into the category of a Part 2 program.

 

Evan Dumas 

No, definitely not.

 

Liath Dalton 

You most likely are either not subject to Part 2 or are a lawful holder, and that’s the important identification and distinction that needs to be made there.

 

Liath Dalton 

So essentially, if you are a Part 2 program, and you used the PCT provided resources ahead of the February 16 deadline, you want to also now incorporate the HHS provided Patient Notice in addition and have that layer on top of your HIPAA NPP. That’s the only caveat there.

 

Liath Dalton 

So now getting back to the whole lawful holder piece. And what still still matters in terms of the resources that we previously shared, that decision guide actually still matters because the federal templates don’t know how practices determine whether Part 2 applies or not.

 

Evan Dumas 

No.

 

Liath Dalton 

They assume that you already know whether you are a Part 2 program, which, if you are a Part 2 program, you will know, but where it can be confusing and there could be an understandable oversight and gap relates to the lawful holder, which, another way of saying that is just a covered entity, a HIPAA covered entity that is maintaining Part 2 records.

 

Evan Dumas 

So that decision guide is still really meaningful, because it helps address that distinction, and we want everyone to be starting with applicability, not the new model language that’s available. Only use it if it’s applicable to you, and use the PCT guide to determine or be one of the supportive steps in determining applicability, since that isn’t something that’s provided for through the HHS resources, basically.

 

Evan Dumas 

Exactly.

 

Liath Dalton 

Yeah. Oh, there it is in a, I was going to say in a nutshell, but that’s a little larger than a nutshell,

 

Evan Dumas 

Coconut shell.

 

Liath Dalton 

in a coconut shell. There it is in a coconut shell. But we just wanted to let everyone know, since HHS has been quiet about this, that the new materials are available directly from them, but then also speak very clearly to what to do if you had used the PCT resources prior to that being available, where the two intersect and whatnot.

 

Liath Dalton 

So please check out the show notes, because we will have links to HHS’ updated model Notice of Privacy Practices, along with the model Part 2 Patient Notice and the companion fact sheet, and then another link as well to the PCT decision guide and sample language resource.

 

Liath Dalton 

So we hope this is helpful. Always have to give a reminder that Person Centered Tech is not a law firm,

 

Liath Dalton 

so this is not legal counsel, and these resources are provided for educational and supportive purposes. And whether you’re using PCT sample or model resources or those of HHS, it’s always advisable to consult with qualified legal counsel when you are making updates to legal documents that you’re providing to clients.

 

Evan Dumas 

No.

 

Liath Dalton 

All right, folks, thanks for joining us, and we’ll talk to you next week. Take care.

 

Evan Dumas 

Mhm.

 

Evan Dumas 

See you next week, everybody.

 

Liath Dalton 

This has been Group Practice Tech. You can find us at personcenteredtech.com. For more podcast episodes, you can go to personcenteredtech.com/podcast or click podcast on the menu bar.