Updated HIPAA Notice of Privacy Practices

By Chris Johnson

What’s Happening in 2026?

**2/19/2026 UPDATE: On Friday, February 13, 2026, HHS released a model notice for the HIPAA Notice of Privacy Practices. No additional action is required at this time for employers who have already implemented the notice we previously shared.

HIPAA requires that health plans update their HIPAA Notice of Privacy Practices when there is a material change to the uses or disclosures of protected health information (PHI). A key update is now required for Health Care FSAs (HCFSAs) and Health Reimbursement Arrangements (HRAs). The rules for distribution are different depending on whether or not your plan has a website/intranet.

If the plan has a website or intranet, it must:

  • Clearly post the updated NPP or changes by the February 16, 2026 effective date and;
  • Include the revised notice or information on how to access it in the next annual mailing to covered individuals.  Click here HIPAA Notice of Privacy Practices for a sample notice. See below for permitted distribution methods.

If the plan does not have a website or intranet, it must:

  • Provide a copy of the revised notice, or information about the changes and how to obtain the revised notice, to covered individuals within sixty (60) days of the effective date of the change. This means you have until April 17, 2026 to distribute. Click here HIPAA Notice of Privacy Practices for a sample notice. See below for permitted distribution methods.

Permitted Distribution Methods (generally)

You can:

  • Include the NPP inside the HCFSA or HRA SPD
  • Add to open enrollment materials
  • Email the NPP directly to covered individuals if they have consented to electronic distribution of plan materials
  • Email a notice telling people where they can electronically access the NPP  
  • Mail a paper copy of the NPP or the availability notice to covered individuals

Final Thoughts and To Do List

The 2026 NPP update may sound complicated, but your to-do list is actually pretty short:

  1. Download and complete the NPP
  2. If you have a website or intranet, post the NPP on your website or internal site(s) and decide how you will distribute it during your next annual mailing.
  3. If you do not have a website, then you have until April 17, 2026 to distribute to covered individuals using one of the above methods.

Navia and our staffs suggestions or recommendations shall not constitute legal advice. No content on our website can be construed as tax or legal advice, and Navia may not be considered your legal counsel or tax advisor. Clients are encouraged to consult with their tax advisor and/or attorney to determine their legal rights, responsibilities, and liabilities. This includes the interpretation of any statute or regulation, federal, state, or local; and/or its application to the clients’ business activities.