If your organization handles protected health information (PHI), you’re required to maintain written privacy policies and procedures—not just a Notice of Privacy Practices (NPP). To make that easier, here’s a comprehensive, copy-ready hipaa privacy policy template you can adapt to your size, workflow, and state requirements. It includes the must-have HIPAA elements, plain-English sample clauses, and an implementation checklist so you can go from “we need a policy” to “we have a usable one” quickly.
Important: This guide is educational, not legal advice. Have counsel review your final policy—especially for state-specific rules (e.g., 42 CFR Part 2, mental/behavioral health, minors’ records, genetic information).
How to Use This Template
- Start with scope. Decide which departments, systems, and data sources are in scope (EHR, patient portal, billing, imaging).
- Adopt the sample clauses. Replace bracketed text with your organization name, roles, systems, and contact details.
- Map to your workflows. Link each policy section to an SOP (who does what, using which tool, and when).
- Train, acknowledge, and audit. Document training and keep signed acknowledgments.
- Review at least annually. Update after major tech or vendor changes, audits, or incidents.
1) Purpose & Scope
Policy Statement (sample):
“[Organization Name] maintains privacy policies and procedures to comply with the HIPAA Privacy Rule. These policies apply to all workforce members, business associates, contractors, volunteers, and trainees who create, receive, maintain, or transmit PHI in any form (electronic, paper, verbal).”
Scope notes:
- Systems: list EHR, practice management, imaging/PACS, billing, patient portal, secure messaging.
- Locations: list clinics, remote work, mobile devices.
- Data types: treatment records, billing data, scheduling, images, lab results, recordings.
2) Definitions (keep short and practical)
- PHI: Individually identifiable health information related to health status, care, or payment.
- Designated Record Set (DRS): Records used to make decisions about an individual (e.g., medical/billing records).
- Minimum Necessary: Limit PHI use/disclosure to the least amount needed to accomplish the task.
- Business Associate (BA): A vendor/service that handles PHI on our behalf (e.g., billing service, cloud vendor).
3) Roles & Responsibilities
Privacy Officer (sample):
“[Name/Title] serves as Privacy Officer, responsible for policy oversight, training, complaints, incident intake, and coordination with the Security Officer.”
Workforce Duties (sample):
“All workforce members must follow these policies, complete HIPAA training before accessing PHI, and report suspected privacy incidents within [X hours].”
4) Permitted Uses & Disclosures of PHI
Core rule (plain English):
We may use or disclose PHI for Treatment, Payment, and Healthcare Operations (TPO) without patient authorization. Certain other uses require authorization or must meet specific conditions (public health, law enforcement, abuse/neglect reporting, health oversight, judicial processes, serious threat to health/safety, etc.).
Sample clause:
“[Organization Name] uses and discloses PHI for TPO in accordance with 45 CFR §164.502 and §164.506. Non-TPO uses require a valid, written authorization unless an exception applies.”
Pro Tip: Create quick SOPs for common disclosures (e.g., sending records to a referring provider, responding to an insurer) so staff don’t guess.
5) Minimum Necessary Standard
Policy (sample):
“We limit PHI to the minimum necessary to accomplish the intended purpose per 45 CFR §164.514(d). We implement role-based access and require staff to de-identify or truncate identifiers when full PHI is not needed.”
Practically:
- Role-based EMR permissions (front desk ≠ full chart access).
- Standard “minimum necessary” checklists for billing, QA, analytics.
- De-identify for training/quality reviews where possible.
6) Patient Rights & Request Handling
Right to access (45 CFR §164.524): Provide access within statutory timeframes, at reasonable, cost-based fees.
Right to amend (45 CFR §164.526): Accept or deny with a written explanation.
Right to restrict disclosures (45 CFR §164.522): Especially when the patient pays in full out-of-pocket.
Right to confidential communications (e.g., alternate address/phone).
Accounting of disclosures (45 CFR §164.528): Maintain logs for non-TPO disclosures.
Sample clause:
“Requests to access, amend, restrict, receive confidential communications, or obtain an accounting must be submitted to [Privacy Officer/contact method]. We respond within [X days] and document all responses in [system/repository].”
Workflow tip: Use a single intake form and ticketing queue so deadlines aren’t missed.
7) Authorizations (When Required)
When needed: Marketing beyond face-to-face communications, sale of PHI, many research uses, most disclosures to employers, and any use not covered under TPO or permitted exceptions.
Authorization form elements (sample):
- Description of information; purpose; recipient; expiration date/event.
- Patient’s signature and date; right to revoke; potential for redisclosure.
Sample clause:
“Non-TPO uses and disclosures require a valid HIPAA authorization. Staff must verify identity, ensure all required elements are present, and upload the signed form to the DRS.”
8) Business Associates & Data Sharing
Policy (sample):
“We execute Business Associate Agreements (BAAs) before granting vendors access to PHI. BAAs must meet 45 CFR §164.502(e) and §164.504(e), including breach reporting and downstream subcontractor obligations.”
Operational checklist:
- Maintain a BA inventory with services, data flows, contacts, and renewal dates.
- Require security reviews and proof of safeguards.
- Disable access promptly when contracts end.
9) Safeguards for PHI (Administrative, Technical, Physical)
Administrative: Training, sanctions, workforce clearance, role-based access, policies/SOPs, vendor management.
Technical: Unique user IDs, MFA where available, automatic logoff, encryption at rest and in transit, audit logs and alerts.
Physical: Facility access controls, device locking, secure disposal (shred bins, media wipe), visitor management.
Sample clause:
“[Organization Name] maintains reasonable and appropriate administrative, technical, and physical safeguards to protect PHI against unauthorized use or disclosure (45 CFR §164.530(c)).”
10) Breach & Incident Response
Definition: An impermissible use/disclosure of unsecured PHI is presumed a breach unless a documented risk assessment shows low probability of compromise.
Response steps (sample):
- Report immediately to Privacy Officer (within [X hours]).
- Contain & investigate (systems affected, PHI elements, number of individuals).
- Risk assessment per 45 CFR §164.402(2): nature of PHI, unauthorized person, whether PHI was acquired/viewed, mitigation.
- Notifications (patients, HHS, media if ≥500 individuals in a state/jurisdiction) within statutory deadlines.
- Corrective actions and documentation.
Standing tools: Pre-built notice templates, an incident log, and a decision tree for “breach vs. no breach.”
11) Training, Sanctions, and Non-Retaliation
Training (sample):
“All workforce members complete HIPAA privacy training before accessing PHI and [annual/refresher] thereafter. Role-specific modules cover front desk, billing, clinical, and IT workflows.”
Sanctions (sample):
“Violations are addressed under a graduated sanctions policy up to and including termination. We enforce non-retaliation for good-faith reports and complaints (45 CFR §164.530(g)).”
Documentation: Keep rosters, completion certificates, and signed acknowledgments.
12) Complaints & Patient Communications
Complaint process (sample):
“Patients may submit complaints to [Privacy Officer contact] or directly to HHS OCR. We document all complaints and outcomes and prohibit retaliation.”
NPP alignment: Ensure your Notice of Privacy Practices references how to lodge complaints and how we use/disclose PHI.
13) Documentation, Retention, and Version Control
Policy (sample):
“We retain HIPAA privacy policies, procedures, training materials, acknowledgments, incident logs, and related documentation for at least six years from the date of creation or last effective date (45 CFR §164.530(j)).”
Version control tips:
- Assign a policy ID, version number, owner, and effective date.
- Keep a change log and archive superseded versions.
- Link each policy to its SOP(s) and training module.
14) State Law & Special Protections
Policy (sample):
“Where state law is more protective of privacy than HIPAA, [Organization Name] follows the stricter rule. Special protections may apply to substance use disorder records (42 CFR Part 2), reproductive health information, mental health, HIV status, genetic data, and minors’ records.”
Action: Add a short appendix listing key state-specific rules that affect your workflows (e.g., parental access nuances, sensitive services).
15) Policy Exceptions & Approvals
Sample clause:
“Any exceptions to this policy require prior written approval from the Privacy Officer and must be documented with a compensating control and expiration date.”
16) Acknowledgment
Sample language for staff signature page:
“I acknowledge that I have read and understand [Organization Name]’s HIPAA Privacy Policy and agree to comply. I understand violations may result in disciplinary action.”
Appendix A — Quick SOP Links (Make These Real)
- Patient access request workflow (intake form, identity verification, delivery format, deadlines)
- Amendment request workflow (review committee, accept/deny letters)
- Accounting of disclosures (log template, when to log)
- Authorization processing (form validation checklist, storage)
- Minimum necessary rules by role (front desk, clinician, billing, IT)
- Common disclosures (referrals, insurers, family/caregivers with patient permission)
- Breach response playbook (triage, risk assessment, notifications)
- On/Off-boarding (access provisioning, least-privilege defaults, termination checklist)
Implementation Checklist (Copy/Paste)
- Name a Privacy Officer and publish a contact method (email/phone).
- Inventory systems and vendors that touch PHI; execute/refresh BAAs.
- Configure role-based access in each system; enable logs and MFA.
- Publish the NPP and ensure it matches your actual practices.
- Roll out training and collect acknowledgments before PHI access.
- Centralize patient rights requests into one queue with timers and templates.
- Stand up a privacy incident intake and breach playbook.
- Set review cadence (annual) and a change-management process.
- Align state-law addendum with counsel; update when laws change.
Common Pitfalls (and How to Avoid Them)
- Confusing NPP with internal policy: You need both—the patient-facing notice and the internal rules and SOPs.
- No minimum-necessary guardrails: Fix with role-based permissions and “view-only” defaults.
- Unmanaged vendors: Keep a BA inventory and renew BAAs before terms lapse.
- Missed deadlines on patient rights: Use ticketing SLAs and one inbox.
- Shadow channels: Disable PHI in consumer chat/email; route to secure, logged systems.
- Policy without practice: Every policy needs a linked SOP and proof of training.
Frequently Asked Questions (Short, Straight Answers)
Is a “privacy policy” the same as the patient Notice of Privacy Practices?
No. The NPP is what patients receive; your privacy policy is the internal rulebook your staff follows.
Do we need written policies if we’re small?
Yes. HIPAA requires written policies, training, and documentation regardless of size.
Can we email records?
Yes, with proper identity checks, safeguards, and patient agreement to electronic delivery. Encrypt whenever possible.
How long do we retain documentation?
At least six years from creation or last effective date—longer if state law or litigation hold requires.
What if a vendor refuses to sign a BAA?
They cannot handle PHI for you. Choose a different vendor or remove PHI from the workflow.
Final Thoughts
A HIPAA privacy policy only works if it’s usable—clear roles, concrete steps, links to SOPs, and training that matches real life. Start with the template above, wire it into your daily tools, and prove it in practice with audits and periodic refreshers. Your staff will know what to do, patients will know what to expect, and your organization will be better protected.
Further reading: U.S. HHS—Summary of the HIPAA Privacy Rule: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
