HIPAA template · Security, Privacy and Breach Notification Rules
HIPAA Privacy Rule Policy
PHI use and disclosure requirements. Written for your company, citing the controls below.
- Sections
- 4
- Controls cited
- 7
- Formats
- PDF, Word
- Shelf
- 12 HIPAAdocuments in all
No card needed to start.
- Cites
- §164.502(a), §164.524(a), §164.308(a)(4) and 4 more
- Formats
- PDF and Word
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Permitted Uses
- Individual Rights
- Minimum Necessary
Controls it cites
The HIPAA controls first, then the matching controls in other frameworks.
- §164.502(a)Uses and Disclosures of PHIHIPAA
- §164.524(a)Access of Individuals to PHIHIPAA
- §164.308(a)(4)Information Access ManagementHIPAA
- GDPR Art. 5Principles of ProcessingGDPR
- GDPR Art. 6Lawfulness of ProcessingGDPR
- SOC 2 P1.1Privacy: NoticeSOC 2
- SOC 2 P6.1Privacy: DisclosureSOC 2
Recent changes
Updates from official sources that name this policy. All policy updates
22 Oct 2026 · The HIPAA Journal
Massachusetts AG settles HIPAA and fraud allegations with Transformative HealthcareReview the Privacy Rule Policy to ensure it addresses the protection of personal and protected health information as required by HIPAA.
14 Jan 2026 · Federal Register
HHS announces Tribal consultation on proposed HIPAA Privacy Rule changesReview the proposed changes to the HIPAA Privacy Rule regarding individuals' right to access their protected health information, including electronic information. Review the proposed changes to the HIPAA Privacy Rule regarding information sharing for care coordination and case management. Review the proposed changes to the HIPAA Privacy Rule regarding family and caregiver involvement in emergencies or health crises. Review the proposed changes to the HIPAA Privacy Rule regarding flexibilities for disclosures in emergency or threatening circumstances.
- HIPAA4 sections
HIPAA Breach Notification Policy
Cites§164.308(a)(6) GDPR Art. 33 GDPR Art. 34 +4 +5PDF · WordCites §164.308(a)(6), Security Incident Procedures (HIPAA); GDPR Art. 33, Breach Notification to Authority (GDPR); GDPR Art. 34, Breach Communication to Data Subject (GDPR), and 4 more. - HIPAA5 sections
Access Control Policy
Cites§164.312(a)PDF · WordCites HIPAA §164.312(a), named in the template description. - HIPAA5 sections
Audit Controls Policy
Cites§164.312(b)PDF · WordCites HIPAA §164.312(b), named in the template description. - HIPAA5 sections
Integrity Controls Policy
Cites§164.312(c)PDF · WordCites HIPAA §164.312(c), named in the template description. - HIPAA5 sections
Transmission Security Policy
Cites§164.312(e)PDF · WordCites HIPAA §164.312(e), named in the template description. - HIPAA5 sections
Contingency Plan
Cites§164.308(a)(7)PDF · WordCites HIPAA §164.308(a)(7), named in the template description.
HIPAA on its own
- Documents
- 12
- Plan
- HIPAA Starter
- Price
- $99 a month or $950 a year
HIPAA Starter covers HIPAA only. HIPAA plus one more framework is Growth, $199 a month.
Your first policy is free. No card needed to start.