Disclaimer
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.
Privacy Policy
View our privacy policy.
Changes to Idaho’s Minor Consent Law
/in Idaho Healthcare LawBy Kim Stanger
Idaho has amended its restrictive minor consent law effective March 31, 2026.1 A redline showing the changes is available at https://legislature.idaho.gov/wp-content/uploads/sessioninfo/2026/legislation/H0860E1.pdf. The amendments address many of the concerns raised by the original act, but problems and questions concerning its application remain. Read more
Update Business Associate Agreements to Comply with New Substance Use Disorder Record Rules
/in HIPAABy Kim Stanger
As of February 16, 2026, the new rules governing the confidentiality of substance use disorder (SUD) records will be enforced. If they have not done so, federally assisted SUD programs (Part 2 Programs) who are covered entities under HIPAA will need to update their business associate agreements (BAAs) to ensure compliance with the new rules.
SUD Confidentiality Obligations. The new Part 2 rules generally prohibit Part 2 Programs from disclosing SUD information without the patient’s written consent. However, the rules contain an exception that allows Part 2 Programs to disclose SUD information to a qualified service organization (QSO) without the patient’s consent so long as the Part 2 Program has an agreement with the QSO that requires the QSO to comply with Part 2. Read more
Do the New Substance Use Disorder Record Rules Apply to You?
/in HIPAABy Kim Stanger
The revised federal rules for substance use disorder (“SUD”) records will be enforced effective February 16, 2026. (42 CFR part 2, hereafter “Part 2”). Failure to comply with the new Part 2 rules may subject healthcare providers and other recipients of covered SUD records to HIPAA penalties ranging from $145 to $2,190,294 per violation along with the affirmative obligation to self-report violations to affected individuals and the Office for Civil Rights. (42 CFR § 2.3; see also 45 CFR § 102.3). Providers rendering SUD treatment or receiving SUD records must determine whether and to what extent the new Part 2 rules apply to them. Read more
Beyond HIPAA: Navigating the “More Stringent” Standard
/in HIPAABy Jake Walker
In light of the upcoming deadline for covered entities to update their Notice of Privacy Practices by February 16, 2026,1 covered entities should consider “more stringent” state laws that may apply to these updated forms and require compliance. The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule (45 C.F.R. Part 164 Subpart E) sets the floor for privacy protections and rights of individuals when it comes to their individually identifiable health information, but allows for states to enact stronger or more stringent requirements regarding the privacy of patient health information. Where federal law sets the ground floor for compliance and allows states to set more demanding requirements as in the case with HIPAA, this is commonly known as “floor preemption.”2 Thus, HIPAA leaves the door open for state law to impose standards more demanding than HIPAA in certain circumstances.
It is critical for covered entities to understand what state laws, if any, may impose additional obligations upon them, and that merely complying with HIPAA is not enough. This is made even more important by the raft of state-specific privacy protection laws that states across the country have implemented within the last decade. The examples below illustrate when and where state law may impose burdens more demanding than HIPAA and the Privacy Rule, but also note where HIPAA preempts other, conflicting state laws. Read more
Update Your HIPAA Notice of Privacy Practices by February 16, 2026
/in HIPAABy Kim Stanger
Recent changes to the HIPAA Privacy Rule require that healthcare providers update their Notice of Privacy Practices (“NPP”) by February 16, 2026.1 Most of the changes are intended to align HIPAA with the revised regulations governing substance use disorder records (see 42 CFR part 2).2 A redlined version of 45 CFR 164.520 showing the changes to the rule is available here.
Background. HIPAA requires covered entities to post and provide individuals with a copy of the provider’s NPP no later than the first day services are delivered.3 The NPP must contain the elements, information and statements specified in 45 CFR 164.520, including but not limited to:
For more information concerning these continuing requirements, see our article at https://www.hollandhart.com/checklist-for-hipaa-notice-of-privacy-practices. Read more