2026 HIPAA NPP Update for Dental Practices — Free Template Included

What Changed in the 2026 HIPAA NPP?

HHS updated the HIPAA Notice of Privacy Practices to integrate 42 CFR Part 2 — the federal regulation governing substance use disorder (SUD) treatment records — directly into the standard HIPAA framework.

Before 2026, 42 CFR Part 2 and HIPAA were separate regulatory tracks with different disclosure rules. The 2026 update merges them, meaning your NPP must now include language about SUD record disclosures even if your dental practice has never treated a single SUD patient.

The ADA confirmed this requirement applies to all dental practices. The HHS rationale: patients need to understand their complete rights under the unified framework, regardless of whether a specific provider is likely to hold SUD records.

Why This Applies to Your Dental Practice

This is the most common question dental offices are asking: "We don't treat addiction patients — why do we need to update our NPP?"

The answer comes down to how HIPAA enforcement works. OCR does not audit practices based on their patient population. It audits based on whether your documentation meets current regulatory requirements. An NPP that doesn't include the 2026-required language is a compliance gap — regardless of whether the missing language is ever clinically relevant to your practice.

Additionally, patient complaints are the most common trigger for OCR investigations. An unhappy patient who researches their rights and finds your NPP doesn't match the current HHS template has grounds for a formal complaint. The complaint doesn't need to involve an actual SUD record — it just needs to identify a documentation deficiency.

What You Need to Update (Two Versions)

Most dental practices have two versions of their NPP that both require updating:

• Website NPP: The electronic version displayed on your practice website. This needs to be replaced with the updated version. If your web team maintains this, send them the new template immediately.
• In-office printed copies: Physical copies in your waiting room and the copies given to new patients at check-in. Old printed copies should be pulled and replaced — don't just leave old copies out because you ordered new ones.
• New patient intake forms: If your intake packet includes an NPP acknowledgment form referencing the version date, that form needs to be updated to reference the new version.
• Documentation: Record when you made the update, who authorized it, and when the new version went live. OCR requests this documentation in audits.

How to Get the Updated NPP Template

HHS provides a free model NPP that already incorporates the 2026 changes. It is available directly from the HHS website and is the safest starting point because it is the government's own template — built to satisfy OCR requirements.

The HHS model NPP is a starting point, not a finished document. You will need to customize it with your practice name, address, and any state-specific requirements that apply in your state. Some states have additional privacy requirements that must be layered on top of the federal baseline.

ADA members can also access the ADA's version of the updated NPP through their member portal. The ADA version includes dental-specific language and can be distributed to patients directly. Note: the ADA version is member-only and cannot be shared or redistributed by dental web agencies to their clients — each practice needs to download it under their own membership.

State-Specific Considerations

Some states impose stricter privacy requirements than federal HIPAA. Your NPP must meet the higher standard when state law and federal law conflict. States with notable additional requirements include:

• California: CMIA (Confidentiality of Medical Information Act) adds protections beyond HIPAA. California dental practices should have their NPP reviewed against CMIA requirements.
• Texas: Texas Health & Safety Code Chapter 181 mirrors HIPAA closely but includes some additional provisions. Texas dental practices using the HHS model NPP should verify alignment.
• Illinois: Illinois PIIA (Personal Information Protection Act) has specific breach notification timelines that are stricter than HIPAA's 60-day window.

What to Do Right Now

If you haven't updated your NPP yet, here are your immediate steps in order of priority:

• Download the updated HHS model NPP from hhs.gov/hipaa and customize it with your practice information.
• Send the new version to your web team or update your website NPP page directly. Note the date it went live.
• Replace all in-office printed copies. Pull old copies from the waiting room and patient intake packets the same day.
• Document the update: who made it, when the new version was approved, and when it replaced the old version. Keep this in your compliance records for at least 6 years.
• If you use a managed compliance platform (like Compliancy Group), notify your Compliance Coach that the NPP update has been completed so it can be logged in your compliance record.