Dentists were required to update their HIPAA privacy notices by February 16, 2026, to reflect new federal rules protecting substance use disorder treatment records, even if they don't treat SUD patients. Many dental practices missed this deadline because they don't realize they handle protected SUD information when patients disclose treatment history or when offices prescribe controlled substances.
- The February 16, 2026 deadline required all HIPAA-covered dental practices to update privacy notices to align with federal Part 2 rules protecting substance use disorder records.
- Dental practices must update notices if they create, receive, maintain, or transmit any Part 2-protected SUD information, including patient disclosures in charts or controlled substance prescriptions.
- OCR auditors check whether updated NPPs are posted in-office and online, whether patients received the updated notice, and whether staff understand the changes.
- An outdated privacy notice is a visible compliance gap that can trigger broader audits or become evidence of a pattern of non-compliance during investigations.
- The ADA updated its sample NPP with specific language for SUD-related disclosures, confirming this requirement applies to general dental practices, not just specialty providers.
Thankfully, it is never too late to update your notice of privacy practices (NPP). If you missed the compliance deadline earlier this year, you're not alone, but you are also not fully compliant. The deadline I refer to came and went quietly in February and changed what many dental offices are required to tell patients about their privacy rights.
Here's what happened, why it applies to practices that assume it doesn't apply to them, and what U.S. Office of Civil Rights (OCR) auditors are actually checking when they show up.
What changed in February
Marshall Strisek.
New federal rules aligned HIPAA's privacy protections more closely with 42 CFR Part 2, the separate federal law governing substance use disorder (SUD) treatment records. As part of that alignment, the U.S. Department of Health and Human Services (HHS) required HIPAA-covered entities that create, receive, maintain, or transmit Part 2-protected SUD records to update their NPPs to reflect new patient rights and disclosure restrictions tied to those records -- even if the practice is not itself an SUD treatment program.
The deadline was February 16, 2026. Any dental practice that touches Part 2-protected SUD information in the ordinary course of care -- even occasionally, even indirectly -- was required to have an updated NPP in place by that date.
Why dental practices assume this rule doesn't apply to them
The instinct is understandable. (I am raising my hand as someone who originally figured this didn’t apply to my dental clients.) We do not think of dental offices as treating substance use disorders, so a rule framed around SUD confidentiality feels like someone else's compliance problem. But the update requirement isn't limited to formal treatment of SUD patients -- it reaches any practice that creates, receives, maintains, or transmits Part 2-protected records at all.
If your office forms ask about (1) substance use or recovery history; (2) if you prescribe controlled substances and coordinate care with a patient's other providers, or (3) if a patient discloses SUD treatment history that ends up in their chart -- all plausible in dentistry -- your practice may be handling exactly the kind of information these rules are designed to protect.
The ADA updated its own sample NPP to reflect the new requirement, with specific language dental practices can adopt for SUD-related disclosures. With the ADA telling its membership to update NPPs, we have a reliable signal this applies to general dental practices, and not just specialty providers.
What OCR auditors are actually looking for
The OCR, which enforces HIPAA, doesn't need a complaint about SUD to flag a missing NPP update. An outdated notice is, on its own, a visible compliance gap -- the kind of thing that shows up in a routine audit or a complaint about something else entirely and then widens into a broader review.
In practice, auditors are checking a few specific things:
- Whether the NPP posted in your office and on your website reflects the February 2026 changes, not an older version.
- Whether patients received the updated notice or a summary of material changes, depending on how your practice handles NPP distribution.
- Whether your staff can explain, at a basic level, what changed and why -- auditors sometimes ask front-desk staff directly, not just review paperwork.
- Whether your broader HIPAA policies (not just the NPP) were updated to stay consistent with the new notice language.
What to do this week
This is a fast fix if you haven't done it yet and a fast way to confirm you're covered if you think you have:
- Pull your current NPP -- the one posted in your office and on your website -- and check the effective date.
- If it predates February 16, 2026, update it. Your compliance consultant, healthcare attorney, or a reputable HIPAA compliance service can supply current model language.
- Confirm the updated version is posted physically in the office, on your website, and available to new patients at intake.
- Brief your front-desk staff on what changed, even at a high level. "We updated our privacy notice earlier this year to reflect new federal rules," is enough for most patient-facing conversations.
The bigger picture
NPP updates are the kind of compliance task that's easy to deprioritize, because nothing seems to happen when you miss one -- until an audit, a complaint, or a data incident puts a red flag on your practice. By then, an outdated notice becomes possible evidence of a broader pattern rather than a one-off oversight.
Check those NPPs (online and offline copies), and make sure you get your updates in place.
Marshall Strisik is the founder of DentalContractsPro.com. He is a healthcare attorney and consultant with two decades of experience advising dentists through DSO acquisitions and practice transitions. Marshall routinely works with new graduates on their first employment agreements.
The comments and observations expressed herein do not necessarily reflect the opinions of DrBicuspid.com, nor should they be construed as an endorsement or admonishment of any particular idea, vendor, or organization.
