I. Scouting Report: How We Got to 2026
Several federal updates issued in 2024–2025 take effect in 2026. This section highlights the developments that drive the 2026 adjustments.
- In early 2024, federal confidentiality rules for substance use disorder (“SUD”) records (“Part 2”) were aligned with general health-privacy rules; compliance is due February 16, 2026.
- A separate 2024 privacy rule related to the protection of reproductive health information was largely struck down by a court in 2025; that did not change the February 16, 2026, requirement to update privacy notices and procedures for the 2024 Part 2 alignment.
- In mid-2025, federal legislation (i) made permanent the COVID-era allowance for pre-deductible telehealth visits for individuals in HSA-eligible HDHPs, (ii) raised the 2026 dependent care account limit, and (iii) clarified how certain direct primary care arrangements interact with HSAs, beginning in 2026.
II. Two-Minute Drill: 2026 at a Glance
This section lists the actions and dates for 2026—privacy updates, plan-year adjustments, optional design choices, and recurring filings.
- By February 16, 2026: Plan to update your Notice of Privacy Practices (“NPP”) and related privacy procedures to reflect the SUD rule changes.
- For 2026 plan years: Add the 2026 preventive-care updates and set out-of-pocket maximums at or below the limits.
- 2026 design choices (optional):
- Pre-deductible telehealth visits for HSA-eligible HDHPs (now permanent).
- Increase the DCAP limit to $7,500 ($3,750 if married filing separately).
- If you offer direct primary care (“DPC”), confirm the design preserves HSA eligibility.
- Every year (continues in 2026):
- December 31: Annual gag-clause attestation (for applicable plans).
- June 1: Annual prescription-drug data filing.
III. Rulebook Update: Privacy by February 16, 2026
By February 16, 2026, group health plans should bring privacy documents and practices up to date. For most plans, that means revising the NPP and updating HIPAA privacy policies and procedures.
What’s changing:
- SUD data under one consent: SUD records may move under a single consent for treatment, payment, and operations; law-enforcement uses, or courtroom testimony still require written authorization or a court order. If a record was not shared under a compliant consent, the stricter rules still apply.
- Documents and enforcement: NPPs must explain Part 2/HIPAA alignment and individual rights, and Part 2 now uses HIPAA-style enforcement and breach rules.
Action items (privacy):
- Update NPPs to reflect how SUD information may be used and disclosed under the aligned rules.
- Update privacy policies and service-provider agreements to reflect HIPAA-style enforcement and breach requirements for Part 2 data and put in place a simple process to obtain and record valid SUD consents.
- Train HR/benefits staff and administrators that SUD information still has extra rules, even though it is now treated more like other HIPAA data.
IV. Lineup Changes: Telehealth, DCAP, HSA
Follow these steps so telehealth, DCAP, and HSA updates are ready for 2026:
- Decide 2026 telehealth design: Choose which HSA-eligible HDHPs will use the permanent pre-deductible telehealth option and update SPDs and enrollment (or later update) materials to reflect this.
- Preserve HSA eligibility: If you offer telehealth or direct primary care, confirm the design keeps participants HSA-eligible and reflect it (if applicable) in your SPD for 2026.
- Raise DCAP limits (optional): If adopting the new cap, amend cafeteria plan/DCAP documents and communications for 2026 to $7,500 (or $3,750 if married filing separately); remind employees not to default to the old $5,000 and recheck nondiscrimination testing as needed.
V. Strong Defense: Preventive & Out-of-Pocket
Because the Supreme Court’s June 27, 2025, decision in Kennedy v. Braidwood Management, Inc. left the preventive-services framework in place, non-grandfathered plans can fold the 2026 updates into the normal update cycle.
- Preventive services: Add the 2026 preventive-care updates to your no-cost list, include any required follow-up/navigation elements, confirm required follow-up imaging/services are treated as preventive, and align SBCs and plan summaries with actual operation.
- Cost-sharing maximums: Set 2026 out-of-pocket maximums at or below $10,600 (self-only) and $21,200 (other-than-self-only). Double-check embedded individual limits in family tiers and HSA-qualified HDHPs and include the new caps in 2026 enrollment materials.
VI. Level Playing Field: Parity—Do Now vs. Defer
The 2024 MHPAEA final rule was expected to take effect in 2025 and 2026 with new prescriptive elements. Litigation and agency non-enforcement announcements have delayed those elements.
What is still required:
- Maintain written NQTL comparative analyses under existing MHPAEA/CAA rules.
- Respond to government requests within required time frames.
- Monitor for disparities (e.g., networks, denials, utilization review) and document fixes.
- Show fiduciary oversight in minutes or internal memos.
- DOL’s existing request authority remains in place; sponsors should assume file requests can occur in 2026.
What is on pause:
- Do not implement the 2024 proposals that would have required you to: (a) show “meaningful benefits” in every classification, (b) collect and fix outcomes/data gaps, and (c) provide a formal fiduciary certification. These items are on hold pending further guidance.
VII. Clock Management: Dec 31 & June 1
These filings are not new and are part of the same 2020–2025 statutory package:
- December 31 each year (next: 2025): Gag-clause attestation for applicable group health arrangements.
- June 1 each year (next: 2026): Prescription-drug data filing. Confirm in 2026 vendor agreements who will provide the files and any plan-level data; watch for format tweaks.
VIII. Coach’s Checklist: 2026 To-Dos
- Inventory ERISA group health plans that are subject to HIPAA and identify which NPPs must be updated by February 16, 2026.
- Draft and circulate updated NPP language (Part 2 alignment, redisclosures, law-enforcement limits) for Human Resources, privacy staff, third-party administrators (“TPAs”) and insurers.
- If adopting the higher DCAP maximum for 2026, plan to amend the cafeteria plan and SPDs to $7,500 (or $3,750 if married filing separately).
- Amend cafeteria plan/SPD documents, as applicable, to describe permanent pre-deductible telehealth for HDHPs and any DPC design that preserves HSA eligibility.
- Plan to add the 2026 preventive-care items and set out-of-pocket maximums at the 2026 levels.
- Reconfirm baseline MHPAEA compliance and keep NQTL analyses current while the 2024 rule is still in partial pause.
- Coordinate 2026 enrollment communications so employees hear about these changes (higher DCAP maximum, durable telehealth, added preventive services, new out-of-pocket caps).
IX. Final Whistle: Before Day One
Line up documents (NPPs, SPDs, cafeteria plans), vendors (administrators, PBMs, carriers), and calendars (December 31 attestations, June 1 prescription-drug filings) so that as January 1, 2026, approaches, these items are already built into plan administration.
With preparation and coordinated updates, employers can start 2026 off with compliant and employee-friendly group health plans. Should you have any questions, please contact Linda L. Hoseman, Aaron M. Weiss or your Neal Gerber Eisenberg attorney.
The content above is based on information current at the time of its publication and may not reflect the most recent developments or guidance. Neal, Gerber & Eisenberg LLP provides this content for general informational purposes only. It does not constitute legal advice, and does not create an attorney-client relationship. You should seek advice from professional advisers with respect to your particular circumstances.
