← Back to Checklist

HIPAA Policy Templates

Core policies required for HIPAA compliance. Customize each section for your organization's specific environment and workflows.

These templates cover the minimum required HIPAA policies. Adapt the language and details to match your organization's size, structure, and technical environment. Have legal counsel review before adoption.

Policy 1: Access Control Policy

Satisfies: 45 CFR §164.312(a)(1), §164.308(a)(3), §164.308(a)(4)

1.1 Purpose

To establish standards for granting, modifying, and revoking access to electronic Protected Health Information (ePHI) based on job function and the principle of least privilege.

1.2 Scope

This policy applies to all workforce members, contractors, and third parties who access systems containing ePHI.

1.3 Policy

1.4 Emergency Access

In emergency situations, temporary elevated access may be granted by the HIPAA Security Officer. All emergency access events shall be logged, reviewed within 24 hours, and documented.

Policy 2: Data Backup and Recovery Policy

Satisfies: 45 CFR §164.308(a)(7)(ii)(A), §164.308(a)(7)(ii)(B)

2.1 Purpose

To ensure the availability and recoverability of ePHI through regular backups and tested recovery procedures.

2.2 Policy

Policy 3: Incident Response Policy

Satisfies: 45 CFR §164.308(a)(6), §164.404, §164.408, §164.406

3.1 Purpose

To establish procedures for detecting, responding to, and recovering from security incidents and breaches involving ePHI.

3.2 Definitions

3.3 Incident Response Procedures

  1. Detection & Reporting: All workforce members must report suspected incidents to the HIPAA Security Officer within 1 hour of discovery via [reporting channel].
  2. Containment: The Security Officer shall immediately assess the incident and take steps to contain and limit the scope of the incident.
  3. Investigation: A formal investigation shall be initiated within 24 hours. The investigation shall determine:
    • What ePHI was involved
    • Who accessed or received the ePHI
    • Whether the ePHI was actually acquired or viewed
    • The extent to which risk has been mitigated
  4. Risk Assessment: Apply the four-factor breach risk assessment per 45 CFR §164.402:
    • Nature and extent of PHI involved
    • The unauthorized person who received or accessed the PHI
    • Whether PHI was actually acquired or viewed
    • Extent to which risk has been mitigated
  5. Notification: If a breach is confirmed:
    • Notify affected individuals within 60 days of discovery
    • Notify HHS — immediately if 500+ individuals affected, annually if fewer
    • Notify media if 500+ residents of a state/jurisdiction are affected
  6. Remediation: Implement corrective actions to prevent recurrence and update the risk register.

Policy 4: Workforce Training Policy

Satisfies: 45 CFR §164.308(a)(5)(i), §164.530(b)

4.1 Purpose

To ensure all workforce members understand their responsibilities for protecting PHI and ePHI.

4.2 Policy

Policy 5: Device and Media Disposal Policy

Satisfies: 45 CFR §164.310(d)(2)(i), §164.310(d)(2)(ii)

5.1 Purpose

To ensure that ePHI is properly destroyed when hardware or electronic media is disposed of or re-used.

5.2 Policy

Document Retention: All policies must be retained for a minimum of 6 years from the date of creation or the date when they were last in effect, whichever is later (45 CFR §164.530(j)). Policies should be reviewed and updated annually or whenever significant changes occur to the organization's environment.