Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Free, no signup needed. A ready-to-fill spreadsheet (.xlsx) with dropdowns and examples.
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: No least-privilege; no access reviews · 164.308(a)(4) Access Mgmt; 164.312(a) Access Control
Exploits: No periodic permissions review · 164.308(a)(4)(ii)(C) Access Review
Template (spreadsheet). The two logs an auditor asks for: the access requests you approved (who got access to what, and who authorized it) and the periodic access reviews you performed.
Evidence that access is granted deliberately and re-checked over time: the approval trail behind access authorization and establishment, plus the record of your periodic reviews.
Two tabs:
Log each access grant when you approve it, with the business justification and approver. On a set cadence (quarterly is common), review each system's accounts and record what you revoked or downgraded. Satisfies access authorization and establishment/modification at 45 CFR § 164.308(a)(4)(ii)(B)–(C) and authorization/supervision at § 164.308(a)(3)(ii)(A).
See where your organization stands on the controls this template cites.
Join Us