2026 HIPAA changes - Why you shouldn't wait to act

March 11th, 2026

From the desk of Meredith Laroe, Director of Compliance, Clarity Benefit Solutions

Every year, I sit down with benefits brokers and HR leaders who ask me the same question: "Are we covered?" And every year, the answer gets a little more nuanced. 2026 is no exception.

The federal government has issued significant clarifications and updates to HIPAA's privacy framework, updates that touch everything from how your health plan handles sensitive health records to what your participants have the right to know about their own data. For employers sponsoring group health plans, flexible spending accounts (FSAs), and health reimbursement arrangements (HRAs), this isn't background noise. This is a compliance call to action.

Let me walk you through what's changed, why it matters, and what you should be doing right now.

Setting the stage: HIPAA and your health plan

Most people associate HIPAA with doctors' offices and hospitals. But HIPAA's reach extends directly into employer-sponsored health plans, and that means it reaches you.

As a plan sponsor, your organization handles protected health information (PHI) every time it processes a claim reimbursement, evaluates plan performance, or coordinates benefits across coverage types. That data is federally protected. And the rules governing how you use, share, and safeguard it are evolving in meaningful ways this year.

What's new in 2026: the changes that matter most

1. Strengthened protections for substance use disorder (SUD) records

This is one of the most significant updates on the table. Under 42 CFR Part 2, now more tightly integrated with HIPAA, the threshold for disclosing substance use disorder patient records has been raised considerably.

Here's what that means in plain English:

You cannot disclose that an employee is enrolled in or has sought treatment through a substance use program without explicit written consent, a qualifying court order, or a defined medical emergency.
Federal law now explicitly prohibits the use of SUD records in civil, criminal, administrative, or legislative proceedings against a participant, absent written consent or a court order meeting strict legal criteria.
Once SUD information is disclosed to a third party outside of treatment, payment, or healthcare operations contexts, that information may lose its HIPAA protections upon redisclosure. This puts significant weight on your initial disclosure decisions.

If your plan has any exposure to SUD-related claims data, and most do, your disclosure protocols need a fresh review today, not next quarter.

2. Tighter guardrails on permitted disclosures

HIPAA has always allowed certain uses of PHI without written authorization, things like plan operations, payment, and public health activities. But recent clarifications are tightening the guardrails around these carve-outs.

Notably, disclosures related to corporate restructuring, mergers, acquisitions, and sales are still permitted, but must meet defined legal requirements. If your organization is going through any structural change this year, your legal and benefits teams need to be aligned before PHI changes hands.

3. Expanded and reinforced participant rights

One of the quieter but genuinely meaningful changes involves the rights your plan participants hold. HIPAA now reinforces, and in some areas strengthens, the following:

Right to inspect and copy: Participants can request and receive copies of their health information held by the plan. Your processes for responding to these requests need to be documented and consistently followed.
Right to amend: If a participant believes their records contain an error, they can formally request a correction. You need a clear, trackable process for handling these.
Right to an accounting of disclosures: Participants can request a log of when and why their PHI was shared, for reasons outside treatment, payment, or standard operations.
Right to restrict: Participants may request limitations on how their data is used. You're not legally required to agree, but you are legally required to consider and formally respond.
Right to confidential communications: Participants can ask that sensitive health information be sent to an alternate address or through alternate channels. Reasonable requests must be accommodated.

These rights aren't brand new, but enforcement scrutiny is sharpening. Are your administrative processes actually equipped to honor them, consistently and on time?

Why this matters more than a compliance checkbox

I talk to a lot of HR teams and benefits brokers who treat HIPAA as a once-a-year exercise. I understand the impulse; the rules are dense, the language is technical, and there's always something more pressing on the calendar.

But here's what I've seen over my career: the organizations that treat privacy as an afterthought are the ones that end up in difficult situations. When a HIPAA violation surfaces , whether it's a wrongful disclosure, a failure to honor participant rights, or a mishandled sensitive record, the consequences aren't just financial. They damage trust. And in benefits administration, trust is everything.

The 2026 updates aren't just about what you can and can't do with health data. They're an opportunity to demonstrate to your employees that your organization takes their privacy seriously.

Your 2026 HIPAA compliance checklist

Here's where to start, this week:

Review and update your notice of privacy practices (NPP) to reflect current rules around SUD records, participant rights, and permitted disclosures.
Audit your disclosure protocols, especially for sensitive health data, to ensure written consent and authorization requirements are being met.
Train your workforce. Anyone who handles PHI on behalf of the plan must understand what's changed and what's expected of them.
Review third-party agreements. If you share PHI with TPAs, brokers, or other vendors, ensure your business associate agreements (BAAs) are current and compliant.
Communicate with participants. They have rights under HIPAA. Make sure they know what those rights are and how to exercise them.
Establish a clear complaint process. Participants must have a pathway to raise privacy concerns, both internally and with the HHS Office for Civil Rights.

Updated HIPAA notices are ready — but the clock is ticking

Knowing the rules have changed is only half the battle. Having the right documentation in place — on time — is the other half.

The good news: the HIPAA notices updated as a result of the 2026 final ruling are already reflected in the Clarity compliance tool. If you sponsor FSA plan documents, ERISA Wrap documents, or standalone HIPAA notices, those documents have been updated within our platform to incorporate the new required language. You don't need to start from scratch — but you do need to act.

Here's the deadline you cannot afford to miss: employers must distribute the updated Notice of Privacy Practices and ensure it is prominently posted on benefit websites. Additional distribution to plan participants must occur no later than April 17, 2026 — or it may be included in the next annual participant mailing, if that mailing occurs sooner.

That means if you haven't yet amended and adopted your plan documents to include this updated language, April 17 is your line in the sand. Missing this deadline isn't a technicality — it puts your plan out of compliance with a federal regulation that is actively being enforced.

Log in to the Clarity compliance tool today, review your FSA plan documents, ERISA Wrap documents, and standalone notices, and confirm that the updated HIPAA language has been adopted. If you're not sure where to start, our team can walk you through it.

The right tools make all the difference, and here's proof

Reading through everything above, you might be thinking: "This is a lot to manage." You're right. It is. Keeping up with HIPAA updates, honoring participant rights, maintaining proper documentation, staying ahead of IRS and DOL requirements, it's a full-time job on top of an already full-time job.

That's exactly why I'm genuinely excited to share something we've been building at Clarity.

We just enhanced our Clarity compliance tool with a capability that removes one of the biggest administrative headaches we hear about from plan administrators: Form 5500 filing is now available directly within the platform, no separate system, no third-party workaround, no chasing down documents at the last minute.

This matters because missed or incomplete Form 5500 filings aren't a technicality. The consequences are real: DOL penalties of up to $110 per day per employee, IRS disqualification, loss of pre-tax status, and back taxes. The same rigor HIPAA demands around protecting participant data, the IRS and DOL demand around filing accuracy and timeliness. One centralized place to manage both sides of that equation is no longer a nice-to-have; it's essential.

The Clarity compliance tool now brings all of your required documentation and filings under one roof:

Form 5500 filing
POP documents
ERISA wrap documents
Section 125 plans
HRA documentation
Commuter plans
Non-discrimination testing

If HIPAA has taught us anything, it's that scattered records and inconsistent processes are where compliance breaks down. A centralized, self-service compliance hub closes that gap and gives you the visibility and confidence to stay ahead of whatever comes next.

To get started, simply log in to the Clarity Portal, choose 5500 filing from the Manage menu, or click the Compliance tool tile on your dashboard. From there, you can review documents, complete filings, and maintain year-round compliance, all in one place.

And this is just the beginning. A more streamlined login experience and a brand-new administrator platform are coming in the weeks ahead, all designed to make staying compliant less of a burden and more of a built-in advantage.

How does this connect to your broader benefits strategy

HIPAA compliance doesn't exist in isolation. It intersects directly with how you structure and administer your account-based health plans, and how those accounts handle sensitive participant data.

If you're evaluating the tax and compliance advantages of different plan types, these resources are worth your time:

And if you're a broker helping clients stay ahead of regulatory change, don't miss: How brokers can future-proof client benefits in 2026

The final word

Compliance is one of those areas where doing nothing feels safe, until it isn't. The 2026 HIPAA updates are a real opportunity to strengthen your practices, protect your participants, and show that your organization means what it says when it comes to privacy.

At Clarity Benefit Solutions, we help employers and brokers navigate exactly this kind of complexity, with practical tools, expert guidance, and benefits administration built for the world we're actually living in.

If you're not sure where your plan stands today, that's the most important question to answer. Visit us to learn more about Clarity!

So, let me ask you now, are you ready to strengthen your benefits compliance program? Get Clarity today!