Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Free, no signup needed. A ready-to-fill spreadsheet (.xlsx) with dropdowns and examples.
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: Endpoint not encrypted · 164.312(a)(2)(iv) Encryption; 164.310(d) Device Controls
Template (spreadsheet). You don't need to draw anything. List each place patient information shows up, one row per flow, and that is your data flow map. It's the companion to your Asset & ePHI Inventory and the foundation your Risk Analysis is built on.
A fill-in map of where ePHI is created or received, where it's processed and stored, and where it goes: the artifact an auditor asks for (and most organizations skip because "diagram" sounds like work). Filling this table answers it, and feeds your Risk Analysis at 45 CFR § 164.308(a)(1)(ii)(A).
One row per flow of patient information:
See where your organization stands on the controls this template cites.
Join UsWork left to right, one row per flow: what data, how it arrives, where it lives, where it goes next, and how. Start from the pre-filled sample rows and replace them with your own. Pull the systems from your Asset & ePHI Inventory and the outside vendors from your BAA list. You don't need every edge case; capture the main paths patient information takes through your organization. Underpins device/media accountability at § 164.310(d)(1) and the Risk Analysis at § 164.308(a)(1)(ii)(A).