A court vacated most of the 2024 Privacy Rule in June 2025 and left the Notice of Privacy Practices changes standing. What survived is Part 2 — substance use disorder records — with a compliance date of 16 February 2026. What did not survive is the reproductive-health prohibition and the attestation requirement, which the eCFR still displays and which are no longer operative.
45 CFR §164.520 · Purl v. HHS, No. 2:24-cv-00228-Z (N.D. Tex. 18 June 2025) · current as of September 2026
This is the part a practice cannot work out from the regulation text, because the regulation text still shows provisions a court has vacated.
The court vacated the 2024 Rule's modifications to 45 CFR parts 160 and 164 at 89 FR 32976–33066. That takes down the reproductive-health prohibition, the attestation framework at §164.509, and §164.535. None of those is an operative requirement today.
The §164.520 modifications were severed and stand — except §164.520(b)(1)(ii)(F), (G) and (H), which the court also vacated because they implemented the unlawful provisions and notice of them was therefore unnecessary.
Part 2 content. The court records that these NPP changes implement CARES Act §3221(i) and derive from the separate substance-use-disorder records rulemaking. They are not surviving reproductive-health protections, and describing them that way misstates both what they require and who they apply to.
The surviving NPP requirements carry their own deadline, separate from the rest of the 2024 Rule: 16 February 2026.
Codified text and enforceable text are different things. The current eCFR rendering of Subpart E still displays §164.509, §164.535 and the reproductive-health provisions. The court order controls their operative status, not the renderer.
Every covered entity must have one, with narrow exceptions — a correctional institution acting as a provider, and certain group health plans that neither create nor receive PHI beyond summary and enrollment information.
The categories of uses and disclosures you may make — treatment, payment and operations described with enough specificity to be meaningful, plus the other permitted purposes and those requiring authorization. Categories, not an inventory of every tool or vendor you use.
Access, amendment, accounting of disclosures, requests for restriction including the mandatory one for a service paid in full out of pocket, confidential communications, a paper copy on request, and the right to complain.
That you are required by law to maintain the privacy of PHI, to provide the notice, and to abide by its terms — plus your right to change it and how you will communicate a change.
How to complain to you and to HHS, a statement that no retaliation will follow, and a contact person or office with a telephone number. Plus an effective date, which is not optional.
Provide the notice no later than the first service delivery, and make a good-faith effort to obtain a written acknowledgment of receipt. If you do not get one, document your good-faith effort and the reason it failed — the documentation requirement is the part practices miss.
Provide the notice as soon as reasonably practicable after the emergency situation ends. No acknowledgment effort is required for emergency treatment.
Where first service delivery is electronic, the notice may be provided electronically in response, automatically and contemporaneously. An individual who receives it electronically retains the right to a paper copy on request.
If you maintain a physical service delivery site, post the notice prominently where individuals can reasonably read it, and have copies available to take. If you maintain a website that describes your services or benefits, the notice must be on it.
You may not implement a material change before the revised notice's effective date. A provider with a physical site posts the revised notice and makes it available going forward; it does not have to mail the revision to everyone it has ever treated. Health plans have their own distribution rules.
Providers and health plans are not interchangeable here. A plan must notify enrollees of a material revision and, where it maintains a website, post the change there. Entities in an organized health care arrangement may produce a single joint notice covering the arrangement, provided it identifies the participants it covers.
Only if you create or maintain records subject to 42 CFR Part 2. A HIPAA covered provider or plan that does must carry the applicable Part 2 content in its notice. Most independent medical and dental practices do not create or maintain Part 2 records, and adding Part 2 language to a notice that does not need it describes practices you do not have — which is its own accuracy problem.
A Part 2 program is a federally assisted program whose principal activity is substance use disorder diagnosis, treatment or referral. It has its own notice obligation under Part 2. A HIPAA covered entity that merely receives or maintains some Part 2 records is not thereby a program, but it still has obligations attached to those records. A Part 2 program that is also a HIPAA covered entity may use a single combined notice satisfying both regimes.
No. HHS publishes model notices as optional aids. They are useful starting points, and a model that does not match how your practice actually handles information is worse than no model at all — the notice has to describe your practices, not a generic set.
No. The attestation framework at §164.509 was part of the 2024 Rule vacated in Purl. It is not an operative requirement, notwithstanding that the section still appears in the eCFR. A notice that describes an attestation process as currently required would be describing a rule that no longer applies.
Not in the sense practices usually assume. You may not implement a material change before the revised notice takes effect, and a provider with a physical site must post the revised notice and have it available. There is no general obligation to mail a revised notice to every past patient. Health plans are subject to different distribution rules.
Patient Protect keeps your policy set and the dated record of what you adopted and when. It does not generate, host, version or record acknowledgment of your Notice of Privacy Practices — and a notice that does not match how your office actually handles information is a gap no software closes.
Get your Patient Protect Score — free