HIPAA Compliance
Professional, regulation-mapped policy documents covering every HIPAA Security Rule, Privacy Rule, and Breach Notification requirement. Customizable for your practice in minutes.
All 23 policies — plus the Medicare audit, compliance binder, and Doc Builder. Free while we’re in beta.
23 Policies
Every HIPAA-required policy
CFR-Referenced
Mapped to specific regulations
Edit in Your Account
Customize online in your account
Free While in Beta
No charge during the beta
Administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect ePHI.
Defines how your practice identifies, evaluates, and mitigates risks to the confidentiality, integrity, and availability of ePHI. Required for every HIPAA-covered entity and the foundation of your entire compliance program.
Establishes consistent consequences for workforce members who violate HIPAA policies and procedures. Demonstrates to auditors that your practice takes compliance seriously and enforces accountability.
Requires regular review of audit logs, access reports, and security incident tracking across all systems that store or transmit ePHI. Critical for detecting unauthorized access before it becomes a breach.
Formally designates the security official responsible for developing and implementing HIPAA Security Rule policies and procedures. This is a required standard that names the individual accountable for your entire security program and defines their authority, duties, and reporting relationships.
Governs authorization, supervision, clearance, and termination procedures for workforce members who access ePHI. Covers the full employee lifecycle from hiring through separation to prevent insider threats.
Controls how your practice authorizes and restricts access to ePHI based on job function. Implements role-based access, isolates clearinghouse functions, and manages access to protected health information on a need-to-know basis.
Mandates ongoing HIPAA security training for all workforce members, including security reminders, malware protection awareness, login monitoring, and password management education. Addresses the most common compliance gap found in audits.
Defines how your practice identifies, responds to, mitigates, and documents security incidents involving ePHI. Establishes the response team, escalation paths, and documentation requirements that are critical during a real incident.
Addresses data backup, disaster recovery, and emergency-mode operations to ensure ePHI remains available during and after an emergency. Covers the three required implementation specifications: backup plan, recovery plan, and emergency mode operations.
Requires periodic technical and non-technical evaluations of your HIPAA security program in response to environmental or operational changes. Ensures your policies stay current as technology, regulations, and your practice evolve.
Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
Governs physical access to facilities that house systems containing ePHI. Covers contingency operations, facility security plans, access control and validation, and maintenance records for physical security measures.
Specifies the proper use of and physical safeguards for workstations that access ePHI. Covers screen positioning, auto-lock requirements, clean desk procedures, and restrictions on workstation functions to minimize risk of unauthorized access.
Governs the receipt, removal, movement, and disposal of hardware and electronic media containing ePHI. Ensures proper sanitization of devices before reuse or disposal and tracks media throughout its lifecycle.
Technology and the policies and procedures for its use that protect ePHI and control access to it.
Establishes technical controls to limit ePHI access to authorized persons and software. Covers unique user identification, emergency access procedures, automatic logoff, and encryption and decryption of data at rest.
Requires implementation of hardware, software, and procedural mechanisms to record and examine activity in systems that contain or use ePHI. Defines what events to log, how long to retain logs, and who reviews them.
Protects ePHI from improper alteration or destruction. Implements mechanisms to authenticate electronic records, detect unauthorized changes, and maintain data integrity across all systems that process protected health information.
Requires procedures to verify the identity of any person or entity seeking access to ePHI. Covers multi-factor authentication requirements, password standards, biometric options, and token-based authentication for your practice.
Guards against unauthorized access to ePHI being transmitted over electronic networks. Addresses encryption of data in transit, integrity controls for transmitted data, and secure communication channel requirements including email and fax.
Standards for the use and disclosure of individuals' health information, and the rights of patients to understand and control how their health information is used.
The patient-facing document that describes how your practice uses and discloses PHI, patient rights, and your privacy obligations. Required to be provided to every patient and posted prominently in your facility.
Requires your practice to limit PHI use, disclosure, and requests to the minimum amount necessary to accomplish the intended purpose. Defines role-based access categories and procedures for routine vs. non-routine disclosures.
Addresses the full spectrum of patient rights under HIPAA: the right to access their records, request amendments, receive an accounting of disclosures, request restrictions, and obtain confidential communications. Essential for front-desk and HIM staff.
A ready-to-use BAA template for engaging vendors, contractors, and service providers who will access PHI on your practice's behalf. Includes all required provisions per HITECH Act amendments and the Omnibus Rule.
Requirements for covered entities and business associates to notify individuals, HHS, and in some cases the media, following a breach of unsecured PHI.
Free While in Beta
All 23 HIPAA policy templates — along with the Medicare audit, compliance binder, and Doc Builder. Everything is included and free while we’re in beta.
all 23 templates, while in beta
Free while we’re in beta · create a free account
Free Tool
Our AI Doc Builder creates custom appeal letters, prior auth requests, call scripts, and more — tailored to your specific claim in seconds.
All 23 policies, checklists, and review templates — alongside the Medicare audit and compliance binder. Free while we’re in beta.
Free while we’re in beta · create a free account