Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Free, no signup needed. A ready-to-fill spreadsheet (.xlsx) with dropdowns and examples.
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: No least-privilege; no access reviews · 164.308(a)(4) Access Mgmt; 164.312(a) Access Control
Template (spreadsheet). Maps each job role to the systems it may reach and at what level: the artifact behind "least privilege" and "minimum necessary."
A grid that documents who should be able to reach what, so you can grant the least each role needs and prove it: the access-decision record behind information access management and minimum necessary.
Rename the sample roles and systems to yours, then set each cell to the least access that role needs. Anything marked A (admin) should be rare and reviewed. Keep the matrix in sync with what's actually provisioned. Satisfies information access management at 45 CFR § 164.308(a)(4)(i) and minimum necessary at § 164.502(b).
See where your organization stands on the controls this template cites.
Join Us