Home / Policy Templates Store / Medical Practices

Healthcare templates

HIPAA Privacy and Security Policy Templates for Medical Practices

Designed for small medical practices with 10 physicians or fewer. Comprehensive templates, an implementation checklist, and an ongoing checklist for your Privacy and Security Officer.

See what’s included

Overview

Close the policy gap your risk analysis finds.

HIPAA requires a security risk analysis and a plan to correct the deficiencies it identifies. A lack of appropriate written policies is one of the most common deficiencies, and these templates correct it quickly.

The policies are updated for the HIPAA Omnibus Rule and the changes mandated by the HITECH Act. For practices implementing HIPAA Security for the first time, a Security Implementation Checklist gives step-by-step instructions for putting the policies in place, and a simple checklist for the Privacy/Security Officer summarizes the ongoing duties that keep you compliant.

Policies can be used in print or on your practice’s server, with hyperlinked citations to the relevant HIPAA regulations and reference materials.

Why these templates

Protect your practice and your patients.

Avoid fines as OCR enforcement continues.

Protect the practice from data loss.

Protect patient confidentiality.

Increase patient satisfaction by protecting their privacy rights.

Contents

What’s included.

About 80 pages in Microsoft Word, organized by audience so staff read only what applies to them.

Confidentiality and privacy policies for all staff

1000Confidentiality, Privacy and Computer Security Definitions
1010HIPAA: General Rules
1020Minimum Necessary Policy
1030Confidentiality Safeguards (Oral and Written)
1040Speaking with the Family and Friends of a Patient Receiving Services
1050Authorizations
1060Verification
1070Minors, Personal Representatives and Deceased Patients
1080Duty to Report Violations and Security Incidents
1090Disclosures that do Not Require an Authorization
1095Patient Portal
1100Fundraising

Patient rights

1200Patient’s Right to Access Records
1210Patient’s Right to Request Amendment of Records
1220Patient’s Right to Receive an Accounting of Disclosures
1230Patient’s Right to Request Additional Restrictions
1240Patient’s Right to Request Confidential Communications

Confidentiality policies for supervisors

1300Mitigation
1310Notice of Privacy Practices
1320Non-intimidation and Non-retaliation
1330Privacy Complaints

Shared privacy and security policies

1340Policy Updating and Staff Training
1350Sanctions for Staff Violations of Privacy/Security Policies
1360Business Associate Contracts
1370HIPAA Assignments and Documentation

Practice owner, administrator and Security Officer

2000HIPAA Security Officer and Security Management Process
2010Data Backup Policy
2020Disaster Recovery Plan and Emergency Mode Operation
2030Facility Security and Access Control
2040Annual Security Evaluation
2050Audit Control and Activity Review Policy
2060Malicious Software Protection Policy
2070Security Awareness Program
2080Device and Media Disposal and Re-Use
2090Technical Safeguards
2100Breach Reporting

Office manager and supervisors

3010Employee System Access and Termination Procedures

Security policies for all staff

3080Computer Usage
3082Use of Social Media
3085Portable Computing Devices and Home Computer Use
3090Security Incident Response and Reporting

Appendices and forms

Appendix A: Identifying Business Associates
Appendix B: Sample HIPAA Business Associate Agreement
Appendix C: Sample Privacy and Security Officer Duties
Appendix D: Facility Security and Safeguards for Oral and Written PHI
Appendix E: Workforce Access to PHI and Safeguards
Appendix F: Minimum Necessary: Procedures for Routine Disclosures and Requests
Appendix G: Miscellaneous
Authorization Form
Notice of Privacy Practices
Disclosure Log
Privacy Instructions
Confidentiality Agreement for Cleaning Agency
Acknowledgement of HIPAA Policies and Procedures

Download today