HIPAA and GDPR Policy Templates for Service Providers
For service providers that serve US and EU healthcare organizations. You are a HIPAA business associate and a GDPR processor or controller, and one manual can cover both.
One manual for two sets of rules.
Service providers that store protected health information and other personal data for US and EU healthcare organizations must abide by both HIPAA and GDPR. These templates are designed for providers of cloud or hosted information systems, data analytics services, and similar services.
They cover the topics both regimes care about: the duty to report violations and security incidents, transparency regarding data practices, data subject rights, marketing and website compliance, lawfulness of processing, data residency, breach reporting, pseudonymisation and de-identification, and disaster recovery.
What you get.
Increase sales with the HIPAA and GDPR compliance prospective customers demand.
Impress customers during their audits and increase retention.
Avoid steep regulatory fines under both HIPAA and GDPR.
Know your organization follows best practices on both sides of the Atlantic.
Protect your organization from costly and embarrassing data loss.
Reduce the risk of a financially devastating breach.
How the templates are set up.
The templates were built under the assumptions below. Modifications are likely needed if they do not match your situation.
- Under GDPR, your organization is a data processor for EU healthcare clients, who are data controllers.
- All data from EU healthcare organizations is maintained in a secure, EU-based data center.
- Sales, marketing, and accounting information is transferred to a US data center.
- Cross-border transfers rely on Standard Contractual Clauses.
What’s included.
About 90 pages in Microsoft Word, with hyperlinked citations to the relevant HIPAA and GDPR provisions and reference materials.
Policies for all staff
- 1000Definitions
- 1010Privacy and Security: General Rules
- 1020Data Classification and Privacy/Security Safeguards
- 1030Confidentiality Safeguards (Oral and Written)
- 1050Computer Usage
- 1060Computing Devices and Workstations: Company-owned and BYOD
- 1070Employee Work at Home
- 1080Duty to Report Violations and Security Incidents
Data subject and patient rights
- 1200Transparency Regarding Data Practices
- 1210Data Subject Right of Access to Personally Identifiable Information
- 1220Data Subject Right to Rectification
- 1230Data Subject Right to Erasure
- 1240Data Subject Right to Request Restriction of Processing
- 1250Complying with Patient HIPAA Rights
GDPR for specific situations
- 1410GDPR: Sales, Marketing and Website Compliance
Access control and human resources
- 1600Employee System Access
- 1610Employee/Contractor Recruiting and Termination
- 1620Security Awareness Program
- 1630Employee Sanctions
GDPR and HIPAA compliance
- 2000Security Officer, Data Protection Officer and EU Representative
- 2010Data Protection by Design and Default
- 2020Lawfulness of Processing and Purpose Limitation Under GDPR
- 2030GDPR and HIPAA Notifications and Documentation
- 2035Privacy-Shield Verification and Certification and GDPR Compliance Validation
- 2040Data Residency, Cross-Border Transfers and Data Facility Security
- 2045Complaint Resolution Under Privacy Shield
- 2050GDPR Agreements: GDPR and Privacy Shield Compliance
- 2060Business Associate Contracts: HIPAA Compliance
- 2070Breach Reporting: GDPR
- 2080Breach Reporting: HIPAA
- 2090Disclosures Required by Law
Software engineering and customer support
- 2500Technical Support Procedures
- 2505Data Conversion and Customer Implementation
- 2510Software Development Procedures
- 2530Intellectual Property
Data security and privacy
- 3000Security Management Process
- 3002Passwords and Encryption Keys
- 3004Pseudonymisation, De-identification, Anonymisation and Storage Limitation
- 3005Data Backup
- 3010Disaster Recovery Plan and Emergency Mode Operation
- 3015Facility Security and Access Control
- 3020Periodic Security Evaluation
- 3025Audit Control and Activity Review
- 3030Malicious Software Protection
- 3033Change Management
- 3040Security Awareness Program
- 3050Device and Media Disposal and Re-Use
- 3052Encryption and Key Management
- 3054User Account Management
- 3056Privileged Account Management
- 3060Technical Safeguards
- 3062Technical Controls for Mobile Devices
- 3090Security Incident Response and Reporting
Appendices and forms
- Appendix A: Identifying Business Associates
- Appendix B: Sample HIPAA BAA for Use with Subcontractors
- Appendix B2: Sample HIPAA BAA for Use with Customers
- Appendix C: Facility Security and Access Plan
- Appendix D: Workforce Access to PHI and Safeguards
- Appendix E: Miscellaneous
- Appendix F: Disaster Recovery Plan
- Appendix G: GDPR Lawfulness of Processing
- HIPAA Disclosure Log
- Employee-Owned Mobile Device Agreement
- Company-Owned Mobile Device Agreement
- Acknowledgement of HIPAA/GDPR Policies
HIPAA and GDPR Policy Templates for Service Providers
Instant download in Microsoft Word. Perpetual license for a single organization. Satisfaction guaranteed.
Need policies built around your organization?
Eagle can tailor any template to your risk assessment, or write custom policies from the ground up. Call us, or send a note and we will follow up.
Talk to Eagle