The February HIPAA Deadline Has Passed — Is Your Notice of Privacy Practices Actually Compliant?

The Deadline Has Passed — But Compliance Isn't Automatic

February 16, 2026 came and went, and most dental practices updated their Notice of Privacy Practices to address the new federal requirements around substance use disorder (SUD) treatment records under 42 CFR Part 2. But updating a document and being compliant with it aren't the same thing.

What the Rule Actually Requires

The updated requirement isn't just adding a paragraph to your NPP. Covered practices need to describe how SUD records protected under Part 2 may be used and disclosed, distribute the revised notice to new patients at intake, post it prominently in the office and on the practice website, and train staff on what changed.

Where Practices Commonly Fall Short After "Updating"

A few gaps show up repeatedly. The website version of the NPP doesn't match the printed version handed out at intake. Front desk staff can recite that "something changed" but can't explain what the SUD language actually means for patients. The revised notice was distributed to new patients but never re-posted in the office itself. Custom intake forms weren't updated to reflect the new language, even though the practice's default templates were.

A Quick Self-Check

Pull the printed NPP from your front desk and compare it, word for word, against what's posted on your website. If they don't match, or if you're not certain your staff could explain the SUD provisions to a patient who asked, that's worth fixing now rather than during an audit.

Compliance Is an Ongoing Responsibility, Not a One-Time Update

A missed or mismatched NPP update is exactly the kind of gap regulators look for, precisely because it happened so recently and so publicly across the industry. A quick compliance check now costs far less than explaining the gap later. Learn more about HIPAA and regulatory compliance for dental practices.