River
Y CombinatorBacked by Y Combinator
Log InStart Free

Free template

HIPAA Policies and Procedures Template

A map of the HIPAA policies a practice needs, plus a breach plan, vendor agreement, staff training and registers for the dated proof behind them.

Edit with AIDownload (.docx + .csv)

Free download · No account needed

What you get

Pack of 8 files: 4 documents, 4 spreadsheets

HIPAA Policies and Procedures Template
  • Policy Set by DomainDocument
  • Business Associate Agreement TemplateDocument
  • Safeguard Evidence RegisterSpreadsheet
  • Policy RegisterSpreadsheet
  • Workforce Training PackDocument
  • Training and Attestation TrackerSpreadsheet
  • BAA RegisterSpreadsheet
  • Breach Response PlanDocument
RiverHIPAA Policies and Procedures Template

Safeguard Evidence Register

One row per implementation specification

Arrives seeded with all forty-eight rows and their citations. You fill the two columns on the right, and they never borrow from each other.

CitationImplementation specificationTypePolicy claims itDated artifact
164.308(a)(1)(ii)(A)Risk analysisRequiredyes
164.308(a)(3)(ii)(C)Termination proceduresAddressableyes
164.308(b)(3)Written contract or other arrangementRequiredyes
164.310(d)(2)(i)DisposalRequiredyes
164.312(a)(2)(iii)Automatic logoffAddressableyes
164.312(a)(2)(iv)Encryption and decryptionAddressableyes
164.316(b)(2)(i)Time limitRequiredyes

19 Required · 22 Addressable · 7 standards with no labeled specification

A downloaded policy set fills the fourth column completely and the fifth column not at all. The fifth column is the one an information request asks for.

Remaining columns: Standard, Artifact Date, Evidence Location, Status, Addressable Decision, Decision Date, Owner, Notes.

Page 1 of 1132 words

How to write HIPAA policies and procedures

HIPAA policies and procedures are the written rules a medical practice follows to protect patient information. They say who may see it, how it is shared, stored and disposed of, and what staff do when something goes wrong. The Privacy Rule and the Security Rule both require them in writing. A good set describes how your practice really works, names an owner for each policy, and points to the dated records that prove it is followed.

One principle matters more than any wording: a policy is a promise, and only a dated record shows you kept it.

A clinician in a white coat and stethoscope writes on a clipboard form in an office lined with binders
Every policy needs a signed, dated record showing it was followed. Photo: Vitaly Gariev on Unsplash

Start with the risk analysis

Do the risk analysis before you write a single policy, because the policies answer what it finds. It is the first item the Security Rule marks as required: an accurate and thorough assessment1 of the risks to the electronic patient information you hold. If yours is missing or out of date, a HIPAA security risk assessment template rates each system against the threats that reach it.

It is also where many organizations fall short. When HHS's Office for Civil Rights audited 166 covered entities in 2016 and 2017, only 14% were substantially fulfilling their risk analysis duties. HHS cited that result in its 2025 proposal to update the Security Rule2, adding that organizations frequently, and wrongly, assumed a purchased security product met every requirement.

Then name your officials in writing. The Privacy Rule requires a privacy official who is responsible for your policies, and the Security Rule requires a security official. When HHS issued the Security Rule in 2003, it said the same person could fill both roles3.

Which HIPAA policies and procedures you need

The Privacy Rule asks for policies reasonably designed for your size and the kind of work you do with patient information4. A three-doctor clinic doesn't need a hospital's binder. It does need every area below, each with the record that proves it runs.

Policy areas and the proof for each

AreaWhat the policies coverThe record that proves it
Officials and sanctionsWho the privacy and security officials are, and what happens when staff break the rulesSigned designations; a log of any sanctions applied
Workforce accessHow access to patient records is granted, changed and endedAccess requests; the date each leaver's accounts were shut off
TrainingWho is trained, on which policies, and whenSigned, dated attestations
Patient rightsYour notice of privacy practices, requests for records, amendments and restrictionsSigned notice acknowledgments; a request log with dates
Uses and disclosuresMinimum necessary access, authorizations, and disclosures allowed without oneA role-by-role access list; signed authorizations
SafeguardsWorkstations, devices, passwords, encryption, backups and disposalDated settings screenshots; wipe certificates; a restore test
VendorsBusiness associate agreements before a vendor handles patient dataSigned agreements naming the vendor's current company
Incidents and breachesHow staff report problems, how a possible breach is assessed, and how patients are notified without unreasonable delay and no later than 60 days after discovery5An incident log, including incidents found not to be breaches
ReviewPeriodic evaluation, plus review after changes to systems or operationsDated review notes, even when nothing changed

Write down what you actually do

Write each policy about your own systems, staff and forms. The policy states the rule, and the procedure under it says who does what, by when, and where the record goes. A downloaded policy describing a workflow you don't run can do more harm than good: it is written proof that you knew the rule and didn't follow it.

Give every policy a header with its version, effective date, owner and next review date. Without an effective date, nobody can work out how long to keep it.

ExampleA termination procedure and its proofAn illustrative example written for this guide. The practice, the leaver and the times are made up.

Policy: Access to every system holding patient information ends on a person's last working day.

Procedure: By 5 p.m. that day, the practice manager turns off the person's records system, email and billing logins, collects keys and badge, and logs each step.

Record: Front desk coordinator, last day Friday, March 13, 2026. Records system off 4:42 p.m., email 4:45 p.m., billing 4:47 p.m., badge returned. Signed by the practice manager.

  • Proof with times. Compare the log with each leaver's last day worked. It is the quickest test of this policy.
  • Addressable, not optional. Termination procedures are addressable. If you choose a different approach, write down why.

An employee offboarding checklist lists every account each role uses, so the procedure never misses one.

Decide every addressable specification in writing

Of the 41 specifications the Security Rule labels required or addressable, 22 are addressable. For each, you must assess whether it is reasonable and appropriate6 for your practice, then either implement it or document why not and adopt an equivalent alternative where reasonable.

Addressable is a decision, not an option. In its 2025 proposal, HHS said its enforcement experience leads it to believe addressable is misunderstood to be optional2. A written decision records:

  • The specification and its citation, such as automatic logoff at 164.312(a)(2)(iii)
  • What your systems support today, with a dated screenshot
  • Your reasoning, weighing your size, technical setup, cost and risk
  • The alternative you adopted, or why none is reasonable
  • The date and who decided

Keep the records that prove it

A binder shows what you meant to do, and records show what you did. When the Security Rule requires an action, activity or assessment to be documented, you must keep a written record of it7. Electronic records count.

Training is the clearest example. You must train every workforce member4, train new staff within a reasonable time, retrain anyone affected by a material policy change, and document each round. Keep signed attestations in your own files, because a completion report inside a training vendor's portal can vanish when the contract ends.

Vendors need the same care. Before a vendor creates, receives, maintains or transmits electronic patient information for you, you need a written business associate agreement1. Build the list from 18 months of payments, then ask what everyone logs into, since free tools never show up on a statement. Answering services, patient survey tools and online intake forms are easy to miss.

Version, keep and review every policy

Never save over an old policy. Documentation must be kept 6 years from its creation or the date it was last in effect7, whichever is later, and the Privacy Rule sets the same clock. A policy adopted in March 2019 and replaced in January 2024 must be kept until January 2030, not March 2025.

Review the set on a schedule and whenever something changes, such as a new records system, office or vendor, and document a revised policy before it takes effect.

A Security Rule update is pending

In January 2025, HHS proposed making nearly every Security Rule specification required2, which would end the addressable category. As of October 2026 it is not final, so the current rule applies. Check its status whenever you review your policies.

Before you adopt the set

  • Every policy matches how your practice works today
  • Policies carry a version, an effective date and a named owner
  • Your privacy and security officials are designated in writing
  • Every skipped addressable specification has a dated, written decision
  • Each vendor that handles patient data has a signed agreement
  • You can find the dated record behind each policy
  • Old versions stay on file for 6 years after they were replaced

When to call a lawyer

This guide and the template are not legal advice. Talk to a healthcare attorney before you answer a regulator's request, decide that an incident is not a reportable breach, or sign a vendor agreement with unusual terms. State laws can add stricter rules.

The HIPAA medical records request template routes patient requests for records and tracks each deadline. To fill this template from the documents you already have, open it in River.

How to use this template

Fill in the files yourself, or open them in River. River asks for the documents you already have, such as your policy binder, a payments export and training reports. It then fills the evidence register row by row, keeping what each policy claims apart from the dated proof behind it. Where it can't find a date, it leaves the cell blank with a note on what would settle it.

Its first report counts the rows with proof, the rows closed by a written decision and the rows still open, and does the same for vendor agreements and training records. It ends with the three fixes that would close the most gaps, each about an afternoon's work, and it never tells you that you are compliant.

  1. Download it or open it in River

    Download the four Word documents and four CSV sheets free, or open the template in River to work from your own files.

  2. Gather what you already have

    Collect your policies, 18 months of vendor payments, training records and signed agreements. Fill the registers yourself, or let River fill them from those files.

  3. Pair each claim with proof

    For every Security Rule row, note the dated proof behind the policy and where it is filed. Leave a blank where none exists.

  4. Close gaps and keep reviewing

    Write decisions for skipped addressable rows, sign missing vendor agreements, and review the set yearly. In River, a weekly check flags what has slipped.

What's in the template

Every document in the packThe Safeguard Evidence Register, the BAA Register, and the Training and Attestation Tracker.
HIPAA Policies and Procedures Template
RiverEvidence Register

Safeguard Evidence Register

Illustrative scoring for a fictional practice, Marlbrook Family Health.

OutcomeRequiredAddressableTotal
Dated artifact on file8412
Written decision not to implementn/a22
Open111627
Labeled specifications192241

The binder scores 41 of 41. The register scores 12. Every one of the forty-one rows had policy text claiming the safeguard, because that is what a downloaded policy set does. Twelve had something dated behind them.

The sixteen are the surprise. The eleven are not. A Required specification with no artifact is a gap the practice can see. An addressable specification skipped with no assessment recorded is a gap nobody knows exists, because addressable reads as optional and is not.

Seven further rows cover the standards in this range that carry no labeled specification, for forty-eight rows in all.

RiverBAA Register

BAA Register

Same fictional practice. Built from an eighteen-month payment export rather than from the vendor list the practice wrote from memory.

StepCountWhat it means
Recurring vendors in the export31Money is the honest source
Create, receive, maintain or transmit PHI14Each with the reasoning recorded
Signed agreement on file95 have none at all
Counterparty verified still current72 name an acquired entity

Seven of fourteen are covered. The five with no agreement are the answering service, the patient survey platform, the copier lease, an ambient scribe tool a clinician started using, and the online intake form vendor. None of them appeared on the list the practice wrote from memory. All five appeared on the card statement.

The two acquired entities are harder to spot than the five. They look closed. An agreement naming a company acquired two years ago may not bind whoever holds the data now, and nothing in a folder of signed PDFs surfaces that.

The register also records the agreed reporting window, who bears notification cost, and whether subcontractors are disclosed. The regulation sets none of those.

RiverTraining Tracker

Training and Attestation Tracker

Same fictional practice. Three obligations tracked separately, because they have different clocks and different triggers.

ObligationOwedRecordedWhere the record lives
Every workforce member23914 only in a closed portal
New joiners44Practice records
Material change retraining110No rows ever opened

The vendor dashboard said 23 of 23 complete. The practice changed training platforms and exported nine attestations before the old contract ended. Fourteen people were trained and there is no retrievable record that they were, which is a different problem from not training them and needs a different fix.

The eleven are the obligation nobody tracks. A material change to a policy opens a retraining obligation for every person whose functions it affects, running from the date the change took effect. Nothing creates those rows unless the policy revision creates them.

The tracker's most useful column asks whether the attestation can be exported from the practice's own records. The export takes an afternoon while the contract is live and can be impossible afterwards.

  • Policy Set by DomainWhich policies a practice needs, what each must cover, and the record that proves each one runs.
  • Business Associate Agreement TemplateThe provisions HIPAA requires in a vendor contract, plus the commercial terms the regulation leaves open.
  • Workforce Training PackFive short staff training modules and a signed attestation recording who was trained, when and on what.
  • Breach Response PlanWhat to do in the first hour, the first four days and the 60 days after discovery.
  • Safeguard Evidence Register sheet48 rows covering every Security Rule standard and specification, with the policy that claims each and its dated proof.
  • Policy Register sheetEvery policy's version, owner and review dates, and how long each version must be kept.
  • Training and Attestation Tracker sheetOne row per person per training duty, and whether the attestation sits in your own records.
  • BAA Register sheetEach vendor that may touch patient data, its agreement, and whether the named company still exists.

Common questions

What policies and procedures does HIPAA require?

HIPAA requires written policies and procedures designed to meet every standard in the Privacy, Security and Breach Notification Rules that applies to you. For a medical practice, that means officials, sanctions, workforce access, training, patient rights, uses and disclosures, safeguards, vendor agreements, breach response, contingency plans and periodic review. How much detail each needs depends on your size and risks.

How long do you have to keep HIPAA policies?

Keep each version for 6 years, counted from when it was created or when it was last in effect, whichever date is later. In practice, a replaced policy stays on file for 6 years after its successor takes over. The same clock covers other records HIPAA requires, such as proof that training happened.

How often should HIPAA policies be reviewed?

HIPAA sets no fixed interval. It requires periodic review, plus updates when changes in your systems or operations affect the security of patient data, such as a new records system, office or vendor. A yearly review is a sensible baseline. Date and sign each review so you can show it happened.

Is a downloaded HIPAA policy template enough to be compliant?

No. A template gives you structure, but HIPAA expects policies designed for your practice and records showing you follow them. Rewrite each policy around your own systems and staff, decide each addressable specification in writing, and keep dated proof such as signed vendor agreements and training attestations.

Can one person be both the privacy official and the security official?

Yes. HIPAA requires a designated privacy official and a designated security official, and HHS has said one person can hold both roles, which often suits a small practice. Put the designation in writing with a date, and name who receives privacy complaints, because the Privacy Rule requires a contact for them too.

Is this HIPAA policies and procedures template free?

Yes. Download the four Word documents and four CSV sheets with no signup. The documents are ready to adapt, and the sheets arrive with their rows and guidance notes in place, including a row for every Security Rule standard and specification. Edit with AI opens the same template in a free River workspace.

What does Edit with AI do?

It opens the template in a free River workspace. River asks for what you already have: your policy binder, 18 months of vendor payments, training reports, signed agreements and any past risk analysis. It fills the registers from them, keeps policy claims apart from dated proof, and reports what is still open. It never declares you compliant.

Sources

  1. eCFR. “45 CFR 164.308 — Administrative safeguards.” ecfr.gov (opens in a new tab)

  2. Federal Register. “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information.” federalregister.gov (opens in a new tab)

  3. Federal Register. “Health Insurance Reform: Security Standards; Final Rule.” govinfo.gov (opens in a new tab)

  4. eCFR. “45 CFR 164.530 — Administrative requirements.” ecfr.gov (opens in a new tab)

  5. eCFR. “45 CFR 164.404 — Notification to individuals.” ecfr.gov (opens in a new tab)

  6. eCFR. “45 CFR 164.306 — Security standards: General rules.” ecfr.gov (opens in a new tab)

  7. eCFR. “45 CFR 164.316 — Policies and procedures and documentation requirements.” ecfr.gov (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

Related tools and templates

More free templates