T-Minus 2 Weeks: Is Your Health Plan’s HIPAA Privacy Notice Updated and Distributed?

Employer-sponsored group health plans have until February 16 to update and distribute their revised Notice of Privacy Practices (“Notice”). Changes to the HIPAA Privacy Rule in 2024 require the Notice to include information regarding Title 42 C.F.R. Part 2: Confidentiality of Substance Abuse Disorder Patient Records (frequently referred to as “Part 2”). In general, if the employer maintains a website that contains health plan information, the Notice must be prominently posted by February 16 and a copy of the Notice provided with the next annual mailing for the plan (e.g., open enrollment materials this fall). If the employer does not maintain a website that contains health plan information, then it must provide the revised Notice within 60 days after February 16 (i.e., by April 17). Employers should consider who should receive the Notice and the method of distribution (e.g., paper vs. electronic).