By Kelli Carpenter Fleming
The Health Insurance Portability and Accountability Act of 1996, and its implementing regulations (“HIPAA”), address how healthcare providers may use and/or disclose patient information. In that regard, HIPAA mandates that healthcare providers implement policies and procedures that address the use and disclosure of patient information. At a minimum, such policies and procedures must be made available to all members of the provider’s workforce, updated periodically, and used to train workforce members on HIPAA obligations.
Along with the HIPAA policies and procedures, healthcare providers must utilize certain HIPAA-related forms. One such form is the Notice of Privacy Practices (“NPP”) that informs patients of not only how their health information may be used and disclosed, but also the rights patients may have under HIPAA. The NPP must be provided to patients at their first appointment, posted on the provider’s website, and displayed in the provider’s office.
There are two recent legal changes that require updates to a provider’s HIPAA-related documents.
First, a provider’s NPP must be updated to account for recent HIPAA changes that take effect on February 16, 2026. These changes relate to the use and disclosure of certain patient information that is protected under 42 CFR Part 2. Part 2 addresses the confidentiality of substance use disorder patient records. While Part 2 only applies to certain Part 2 programs (i.e., providers who hold themselves out as providing substance use disorder treatment), the changes related to Part 2 have a broader reach. The required changes to the NPP are not only for Part 2 programs, but are also for any providers that may receive substance use disorder patient records from a Part 2 program. For those providers, the NPP must address that certain uses and disclosures permitted by HIPAA may be prohibited or limited by Part 2, and note that one such limitation relates to the provider’s inability to use or disclose Part 2 information in civil, criminal, administrative, or legislative proceedings against the patient except in limited circumstances. Thus, all providers who may potentially receive information from a Part 2 program should include these revisions in their NPP. These changes must be implemented on or before February 16, 2026.
Second, a provider’s policies and procedures regarding access to patient information must be updated to account for state law changes regarding the age of consent. Alabama’s age of medical consent increased from 14 years old to 16 years old beginning October 1, 2025. Even once a child reaches age 16, parents and guardians continue to have certain rights with regard to accessing their child’s medical records. Though the law allows minors age 16 and above to make their own health care decisions, parents or guardians will, in most cases, continue to have the right to access their child’s medical records. New provisions of the law grant parents and guardians the ability to access a minor’s information, with limited exceptions, until the minor reaches the age of 19, regardless of who consents to the treatment. Consequently, providers should update their HIPAA policies and procedures to address the state law changes regarding the age of consent and the parents continuing right to access the minor’s medical information.
As 2026 gets underway, healthcare providers should review and revise their HIPAA policies, procedures, and related forms to address these recent changes. A failure to implement updated HIPAA compliance documents can result in violations of the law and create compliance hurdles.
Kelli Fleming is a Partner at Burr & Forman LLP practicing exclusively in the firm’s Health Care Practice Group. Kelli may be reached at (205) 458-5429 or kfleming@burr.com.
