HIPAA Policy Templates for Health Insurance Brokers
The insurance companies you represent, and your customers, expect HIPAA compliance. Quick-start the process with templates built for brokers selling in the group market, the individual market, or both.
As an agent for health insurers, you are a business associate.
Eagle’s HIPAA policies for health insurance brokers are designed for brokers who sell medical, dental, and vision policies. As agents for health insurance companies, brokers are HIPAA business associates and must have detailed, written HIPAA policies and procedures.
HIPAA regulates fully insured and self-insured group and individual health benefit plans, health savings accounts, flexible spending accounts, and other plan types. These policies comply with the HITECH Act, the Breach Notification Rule, and the 2013 Omnibus Rule. Version 2.0 was fully updated for cloud technology and employee work-at-home arrangements.
What you get.
Satisfy health insurer requirements and move through their audits.
Organized by audience to simplify staff training.
Bring your technology into compliance with HIPAA rules as they apply to brokers.
Saves thousands of dollars in consulting fees.
Customize in Microsoft Word to fit your agency.
Satisfaction guaranteed by Eagle.
Avoid HIPAA penalties.
Your agency is subject to both civil and criminal penalties for non-compliance. OCR can impose civil money penalties in four tiers based on culpability, from violations the organization did not know about to willful neglect that was never corrected. Amounts are adjusted for inflation each year, annual caps per violation type reach into the millions, and state attorneys general can bring their own actions. Written policies and procedures are one of the first things investigators ask to see.
What’s included.
Every policy is delivered in Microsoft Word, organized by audience so staff read only what applies to them.
HIPAA policies for all staff
- 1000Confidentiality, Privacy and Computer Security Definitions
- 1010HIPAA: General Rules
- 1020Minimum Necessary Policy
- 1030Confidentiality Safeguards (Oral and Written)
- 1035Prohibitions on Use of Genetic Information and Sale of PHI
- 1040Speaking with the Family and Friends of a Participant
- 1050Authorizations
- 1060Verification
- 1065Employee Work at Home
- 1070Minors, Personal Representatives and Deceased Participants
- 1080Duty to Report Violations and Security Incidents
- 1090Disclosures that do Not Require an Authorization
Participant rights
- 1200Participant’s Right to Access Records
- 1210Participant’s Right to Request Amendment of Records
- 1220Participant’s Right to Receive an Accounting of Disclosures
- 1230Participant’s Right to Request Additional Restrictions
- 1240Participant’s Right to Request Confidential Communications
Confidentiality policies for supervisors
- 1300Mitigation
- 1340Privacy Complaints
Shared privacy and security policies
- 1350Policy Updating and Staff Training
- 1360Sanctions for Staff Violations of Privacy/Security Policies
- 1370Business Associate Agreements and Vendor Management
- 1380HIPAA Assignments and Documentation
Administrative management
- 1500Employee Background Checks
Security policies for the owner and Security Officer
- 2000HIPAA Security Officer and Security Management Process
- 2010Data Backup Policy
- 2020Disaster Recovery and Emergency Mode Operation Plans
- 2030Facility Security and Access Control
- 2040Periodic Security Evaluation and/or Third-Party Audits
- 2050Audit Control and Activity Review Policy
- 2060Malicious Software Protection Policy
- 2070Security Awareness Program
- 2080Device and Media Disposal and Re-Use
- 2085Encryption and Key Management
- 2087User Account Management
- 2088Privileged Account Management
- 2090Technical Safeguards
- 2092Technical Controls for Mobile Devices
- 2095Change Management
- 2100Breach Reporting
Executive management and Security Officer
- 3010Employee System Access and Termination Procedures
Security policies for all staff
- 3080Computer Usage
- 3082Use of Social Media
- 3085Computing Devices and Workstations: Company-owned and BYOD
- 3090Security Incident Response and Reporting
Appendices and forms
- Appendix A: Identifying Business Associates
- Appendix B: Sample HIPAA BAA for Use with Subcontractors
- Appendix B2: Sample HIPAA BAA for Use with Customers
- Appendix C: Sample Privacy and Security Officer Duties
- Appendix D: Facility Security and Safeguards for Oral and Written PHI
- Appendix E: Workforce Access to PHI and Safeguards
- Appendix F: Minimum Necessary: Procedures for Routine Disclosures and Requests
- Appendix G: Miscellaneous
- Authorization Form
- Disclosure Log
- Participant Privacy Instructions
- Confidentiality Agreement for Cleaning Agency
- Employee-Owned Device Agreement
- Company-Owned Device Agreement
- Employee Acknowledgement of HIPAA Policies and Procedures
Gary Pritts, Founder and President
Gary Pritts is Founder and President of Eagle Consulting Partners. He began his HIPAA work providing technical input during the federal government's original drafting of the HIPAA regulations, and has since served more than 1,000 organizations as a consultant, as well as serving as a hospital trustee and as CSO for a cloud healthcare messaging company. Gary studied computer science at Purdue University and holds an MBA from Harvard Business School.
Gary understands brokers from on-site consulting with multiple brokerage agencies. His knowledge of the HIPAA rules, health insurer requirements for brokers, ERISA, and state regulations shaped these templates, which are designed around the audience that has to follow them.
HIPAA Policy Templates for Health Insurance Brokers
Instant download in Microsoft Word. Perpetual license for a single organization. Satisfaction guaranteed.
Save 20% ($100) with code Save-20 at checkout
Need policies built around your organization?
Eagle can tailor any template to your risk assessment, or write custom policies from the ground up. Call us, or send a note and we will follow up.
Talk to Eagle