HIPAA template · Security, Privacy and Breach Notification Rules
HIPAA Security Rule Policy
Administrative, physical, and technical safeguards. Written for your company, citing the controls below.
- Sections
- 5
- Controls cited
- 8
- Formats
- PDF, Word
- Shelf
- 12 HIPAAdocuments in all
No card needed to start.
HIPAA5 sections
HIPAA Security Rule PolicyAdministrative, physical, and technical safeguards.
- Cites
- §164.308(a)(1), §164.308(a)(2), §164.310(a)(1) and 5 more
- Formats
- PDF and Word
HIPAA shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Administrative Safeguards
- Physical Safeguards
- Technical Safeguards
- Risk Analysis
Controls it cites
The HIPAA controls first, then the matching controls in other frameworks.
- §164.308(a)(1)Security Management ProcessHIPAA
- §164.308(a)(2)Assigned Security ResponsibilityHIPAA
- §164.310(a)(1)Facility Access ControlsHIPAA
- §164.312(a)(1)Access ControlHIPAA
- §164.312(e)(1)Transmission SecurityHIPAA
- SOC 2 CC5.1COSO Principle 10: Control ActivitiesSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- CSF PR.PS-1Platform SecurityNIST CSF
Recent changes
Updates from official sources that name this policy. All policy updates
22 Oct 2026 · The HIPAA Journal
Massachusetts AG settles HIPAA and fraud allegations with Transformative HealthcareReview the Security Rule Policy to ensure it includes requirements for maintaining an appropriate written information security program.
- HIPAA4 sections
HIPAA Privacy Rule Policy
Cites§164.502(a) §164.524(a) §164.308(a)(4) +4 +5PDF · WordCites §164.502(a), Uses and Disclosures of PHI (HIPAA); §164.524(a), Access of Individuals to PHI (HIPAA); §164.308(a)(4), Information Access Management (HIPAA), and 4 more. - HIPAA4 sections
HIPAA Breach Notification Policy
Cites§164.308(a)(6) GDPR Art. 33 GDPR Art. 34 +4 +5PDF · WordCites §164.308(a)(6), Security Incident Procedures (HIPAA); GDPR Art. 33, Breach Notification to Authority (GDPR); GDPR Art. 34, Breach Communication to Data Subject (GDPR), and 4 more. - HIPAA5 sections
Access Control Policy
Cites§164.312(a)PDF · WordCites HIPAA §164.312(a), named in the template description. - HIPAA5 sections
Audit Controls Policy
Cites§164.312(b)PDF · WordCites HIPAA §164.312(b), named in the template description. - HIPAA5 sections
Integrity Controls Policy
Cites§164.312(c)PDF · WordCites HIPAA §164.312(c), named in the template description. - HIPAA5 sections
Transmission Security Policy
Cites§164.312(e)PDF · WordCites HIPAA §164.312(e), named in the template description.
HIPAA on its own
- Documents
- 12
- Plan
- HIPAA Starter
- Price
- $99 a month or $950 a year
HIPAA Starter covers HIPAA only. HIPAA plus one more framework is Growth, $199 a month.
Your first policy is free. No card needed to start.