Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Template. The one-page mandate that establishes your HIPAA program: who owns it, what it covers, and the authority behind it. Sign it at the top of the organization. Replace
[bracketed]items. Satisfies the security management process at 45 CFR § 164.308(a)(1)(i) and assigned security responsibility at § 164.308(a)(2).
[Organization] establishes and maintains a HIPAA Security & Privacy Program to protect the confidentiality, integrity, and availability of the protected health information (PHI) it handles, and to comply with the HIPAA Privacy, Security, and Breach Notification Rules. This Charter authorizes the program and the roles below, effective [YYYY-MM-DD].
The program covers all PHI [Organization] creates, receives, maintains, or transmits; all workforce members, systems, facilities, and devices that touch it; and all business associates and subcontractors engaged to handle it.
[Security Official] (required, § 164.308(a)(2)): owns the Security Rule program: risk analysis, safeguards, incident response, and this Charter. Reports to [executive sponsor].[Privacy Official] (required, § 164.530): owns the Privacy Rule program: uses/disclosures, individual rights, the Notice of Privacy Practices, and training.[Executive sponsor]: provides authority and resources and reviews the program annually.These roles have the authority to set policy, require remediation of identified risks, and enforce sanctions for violations.
Risk analysis and risk management; workforce training and sanctions; access management; contingency planning; incident response and breach notification; vendor/business-associate management; and the supporting policies, procedures, and records in the HowToHIPAA library.
Reviewed and re-affirmed at least annually by the [Executive sponsor] and [Security Official]. Signed: [name / title / date]. v1.0.
See where your organization stands on the controls this template cites.
Join Us