10 Top HIPAA Policies and Procedures Templates to Manage Compliance

There is no way around HIPAA rules.

If your organization touches protected health information, HIPAA compliance is not optional. You need policies, procedures, training, documentation, and repeatable workflows that show the right steps were followed.

That is why HIPAA policies and procedures templates are useful. They give healthcare teams a structured starting point for privacy, security, breach response, business associate agreements, patient intake, and other compliance-sensitive processes.

The risk is still real. HHS tells covered entities to report breaches of unsecured protected health information, and breaches affecting 500 or more people must be reported without unreasonable delay and no later than 60 calendar days from discovery. IBM’s 2025 Cost of a Data Breach Report also keeps healthcare near the top of the costliest industries for data breaches.

Templates do not replace legal review, risk analysis, or a real compliance program. But they can help you turn requirements into assigned work, due dates, approvals, records, and audit-ready proof.

In this post, you will find 10 Process Street HIPAA and healthcare operations templates you can adapt for your team.

Process Street’s HIPAA policies and procedures templates

HIPAA policies and procedures should translate privacy, security, and breach notification obligations into work people can actually follow. A useful template set should cover who owns each policy, what evidence is collected, when reviews happen, how exceptions are escalated, and where completion records live.

For 2026, pay special attention to Security Rule operations. HHS published a Security Rule notice of proposed rulemaking in late 2024 to strengthen cybersecurity safeguards for electronic protected health information, while the existing HIPAA Security Rule remains in effect. That makes documented, reviewed, and tested procedures even more important.

Not to worry though. With the correct processes in place, you can maintain compliance without having to deal with any unwelcome surprises. It’s also not expensive to set up an effective solution. Our healthcare compliance solution is designed to help your team stay organized, audit-ready, and free from unexpected issues.

The costs involved in implementing a secure messaging solution, conducting risk assessments and training employees to use the solution are much less than commonly believed. – Marc Ladin, The Importance of HIPAA Compliance: 7 Things You Should Know

This Process Street template pack provides ten checklists that have been designed for the sole purpose of helping your institution maintain compliance with HIPAA policies and procedures. For a broader look at how we support compliance teams, check out our compliance software solution.

By integrating these checklists into your HIPAA management efforts, you will increase accountability, transparency, and provide your team with the tools they need to execute important workflows.

In this post, we will be covering:

• HIPAA Compliance Checklist
• HIPAA Compliance Checklist for HR
• HIPAA Privacy Risk Assessment Checklist
• HIPAA Security Breach Reporting Checklist
• HIPAA Data Backup Plan Checklist
• HIPAA Omnibus Rule Checklist
• HIPAA Business Associate Agreement Checklist
• Patient Intake Checklist for a Medical Clinic
• Patient Intake Checklist for a Dental Clinic
• Patient Satisfaction Survey Checklist
• Process Street is here to help you minimize the risk of ever facing a HIPAA violation
• Other useful resources for healthcare professionals

Our 10 checklists to help you stay compliant with HIPAA policies and procedures

HIPAA Compliance Checklist

The primary purpose of HIPAA is simply to keep people’s healthcare data private. If your healthcare organization is an entity that uses and has access to PHI, then you are classified as a Covered Entity (CE) and need to make sure you are compliant with HIPAA regulations.

There are three critical components to PHI security:

• Technical safeguards
• Physical safeguards
• Administrative safeguards

Each part is equally important and must be satisfied to ensure HIPAA compliance.

This is a general compliance checklist that guides you through satisfying the requirements for each of the three safeguards.

While going through the checklist, bear in mind that the requirements of HIPAA are intentionally vague so that it can be applied equally to different types of covered entities that come into contact with PHI.

It should also be noted that this checklist is a self-evaluation tool. Successfully completing it does not guarantee you are HIPAA compliant. To be sure, you should always consult a HIPAA compliance expert.

Click here to get the HIPAA Compliance Checklist

HIPAA Compliance Checklist for HR

As HIPAA has been amended over the years, it has adapted to the digital world by introducing strict measures to address the threat of cyber crime. This has placed much of the responsibility that comes with HIPAA compliance on IT departments.

Nevertheless, HIPAA obligations stretch far beyond IT security, as the healthcare industry is ultimately dependent on human interaction, and HIPAA security is dependent on proper employee training.

HR departments should not assume that the IT department is solely responsible for HIPAA compliance. There are important steps that need to be taken during employee onboarding in order to comply with the privacy rule.

For example, employees enrolled in a self-insured group health plan must be given a Privacy Practice Notice informing them of their HIPAA-related rights. This is very straight-forward and rarely overlooked, but some HR departments forget to send updates when privacy practices are revised, or a reminder at least every three years.

These are the little things that can prove costly down the line if not quickly identified and addressed.

This checklist will take you through the process of conducting a security risk audit, performing HIPAA training, assessing PHI security, and evaluating relationships with business associates.

Click here to get the HIPAA Compliance Checklist for HR

HIPAA Privacy Risk Assessment Checklist

The requirement for covered entities to conduct a HIPAA risk assessment was introduced in 2003 with the original HIPAA Privacy Rule.

Conducting periodic risk assessments is not only required by law, but will also help you avoid potential violations that can be incredibly costly.

“More recently, the majority of fines have been under the “Willful Neglect” HIPAA violation category, where organizations knew , or should have known , they had a responsibility to safeguard their patients´ personal information. Many of the largest fines , including the record $5.5 million fine issued against the Advocate Health Care Network , are attributable to organizations failing to identify where risks to the integrity of PHI existed.” – HIPAA Journal, HIPAA Risk Assessment

Facing a sudden data breach by a group of skilled cyber-crime attackers would be a lot more damaging if an investigation showed that the breach could have been avoided, and was largely due to a failure to identify and safeguard risks.

This checklist is designed to guide you through a comprehensive evaluation of your compliance with the HIPAA Privacy Rule, and to identify areas that need to be addressed to improve PHI security.

The template is split up into the following sections:

• Check-in procedures (patient identity verification, insurance, etc.)
• Clinical areas (ensuring no PHI is visible/accessible)
• Medical records (staff access, physical security, patient authorization)
• General security (computer monitors, paper records)
• Personnel policies (employee training, documentation)

Once the checklist is complete, you will have an accurate understanding of how well your organization is protecting PHI. You will also identify areas that need to be addressed and set out clear action items to optimize security measures.

Click here to get the HIPAA Privacy Risk Assessment Checklist

HIPAA Security Breach Reporting Checklist

Security breaches in the healthcare industry are, unfortunately, all too common.

“Between 2009 and 2019 there have been 3,054 healthcare data breaches involving more than 500 records. Those breaches have resulted in the loss, theft, exposure, or impermissible disclosure of 230,954,151 healthcare records. That equates to more than 69.78% of the population of the United States. In 2019, healthcare data breaches were reported at a rate of 1.4 per day.” – HIPAA Journal, Healthcare Data Breach Statistics

With the risk of a breach being so high, it’s imperative that both covered entities and business associates take the appropriate measures to identify and report breaches as early as possible.

Currently, the figures suggest that not enough is being done.

“What’s worse is that it took the breached US organizations an average of 245 days to identify and contain a breach. However, the report tied breach response directly to cost saving. Organizations that detected and contained the breach in less than 200 days spent $1.2 million less on total breach costs.” – Jessica Davis, Data Breaches Cost Healthcare $6.5M, or $429 Per Patient Record

This checklist template has been built to help you identify and report data breaches as efficiently as possible. Our dynamic due dates feature will ensure that you file a notice to the secretary of the HHS within 60 days, while conditional logic will automatically customize the checklist depending on whether you are the covered entity or a business associate, and whether the breach affected more or less than 500 individuals.

Click here to get the HIPAA Security Breach Reporting Checklist

HIPAA Data Backup Plan Checklist

Backing up data is important for everybody, whether it be personal data or data belonging to an organization. When it comes to ePHI managed by a healthcare institution, the level of importance could not be higher.

It is also a mandatory component of HIPAA compliance.

In order to meet these requirements, most healthcare organizations choose to outsource critical IT services to a third party i.e. an MSP. Whether or not you outsource data backup services, measures must be taken to ensure that you do not lose sensitive patient data, as the consequences can be devastating.

“The data backup plan is a required stage of compliance and must form part of a contingency plan that meets HIPAA standards. Losing data has huge consequences, even-more-so for healthcare organizations who routinely handle sensitive and private data. If access to critical pharmacy systems, lab systems or EHR systems was severed, a healthcare practice would struggle to continue business operations. This risks damaging reputation and ultimately could risk patient lives.” – Marty Puranik, What Is Your HIPAA Data Backup Plan

This process will help you establish a solid data backup plan that satisfies HIPAA requirements and clearly shows your patients that you have appropriate safeguards in place to protect their data.

From identifying the databases that contain ePHI, determining which solution will be used, testing the restore process, and formally documenting the backup policy, this checklist will help you set up the data backup plan end-to-end, hopefully relieving your security team of stress in the process!

Click here to get the HIPAA Data Backup Plan Checklist

HIPAA Omnibus Rule Checklist

The Omnibus Rule was introduced in 2013 as a way to amend the HIPAA privacy and security rules requirements, including changes to the obligations of business associates regarding the management of PHI.

The rule merges the following four separate rule makings:

• Amendments to HIPAA Privacy and Security rules requirements
• HIPAA and HIPAA HITECH under one rule now
• Further requirements for data breach notifications and penalty enforcement
• Approving the regulations in regards to the HITECH Act’s breach notification rule

The Omnibus rule includes regulations that will:

• Manage the use of patient information in marketing
• Includes a provision that requires healthcare providers to report data breaches that are deemed not harmful
• Makes certain that business associates and subcontractors are liable for their own breaches and requires Business Associates to comply with HIPAA

Although all healthcare institutions had to make changes and adhere to the Omnibus Rule when it was implemented, this checklist provides you with an easy way to evaluate compliance on a periodic basis.

Click here to get the HIPAA Omnibus Rule Checklist

HIPAA Business Associate Agreement Checklist

A Business Associate Agreement (BAA), is a written arrangement that specifies each party’s responsibilities when it comes to PHI.

The HIPAA Privacy Rule requires all covered entities (CEs) to have a signed BAA with any Business Associate (BA) they hire that may come in contact with PHI.

According to HHS, a BAA must include the following information:

• Description of the permitted and required use of PHI by the BA.
• Provide specific requirements regarding how and when the BA will not use or further disclose PHI.
• Outline requirements for the BA to use appropriate safeguards to prevent inappropriate PHI use or disclosure.

This checklist will guide you through the process of creating and implementing a BAA.

As a covered entity, you will need to work in tandem with the BA to complete the agreement. This need for collaboration has been taken into account as the approval tasks require approval from both the CE and BA.

This means that you can efficiently move through the process knowing that there will not be any disagreements or disruptions when it comes time to confirm and implement the agreement.

Click here to get the HIPAA Business Associate Agreement Checklist

Patient Intake Checklist for a Medical Clinic

How you manage the patient intake process will set the tone for the rest of your relationship, in addition to establishing the infrastructure for paperwork and data storage which is a critical aspect of HIPAA compliance.

There are three main elements that make up a good patient intake process:

• Proper handling of patient’s time, data, and privacy
• Making the process as convenient as possible for the patient
• Making sure all communication is clear and overstated

The patient intake process gives you an opportunity to get everything you need to properly assess and start working with the patient. Compliance plays a big part in this, with HIPAA documents and needing to be signed both before patients enter into your system of care, and updated at the beginning of each fiscal year.

This checklist template is designed to make the patient intake process as efficient as possible for you and your new patients.

Click here to get the Patient Intake Process for a Medical Clinic

Patient Intake Checklist for a Dental Clinic

When a new patient walks through the door of your dental clinic, you don’t want to have to force them to manually complete important documents.

Not only does it require more time and effort than digital alternatives, but it also leaves your patients feeling more stressed, which can negatively impact long-term patient retention.

This checklist automates much of your patient intake process and allows your patients the freedom to cooperate with you to complete the tasks digitally. With a reduction of manual entry, time spent on administrative processing is greatly reduced.

By using this checklist template you can rest assured that the patient intake process at your dental clinic is optimized, so you won’t have to worry about losing time to slow patients filling their forms in on the day of their appointment.

Click here to get the Patient Intake Checklist for a Dental Clinic

Patient Satisfaction Survey Checklist

It is becoming increasingly apparent in the healthcare industry that the patient experience and overall patient satisfaction is an important metric that directly impacts patient recovery and provides significant opportunities to optimize internal processes.

“High patient satisfaction scores usually result in higher reimbursement payments from the Centers for Medicare & Medicaid Services (CMS), better patient retention rates, and the assurance for hospital staff that they fostered a positive experience for patients.” – Sara Heath, How Hospitals Can Raise Patient Satisfaction, CAHPS Scores

In fact, a report from Vocera showed that patient satisfaction is the top-ranked priority at healthcare organizations, and that 64 percent of organizations value patient experience leaders the same as they value patient safety and clinical workflow leaders.

By completing the checklist, you will gain actionable insight into how patients are feeling about their treatment, and what can be done to deliver a more satisfying experience in the future.

It’s all about continuously optimizing processes to deliver the best care possible!

Click here to get the Patient Satisfaction Survey Checklist

How Process Street helps reduce HIPAA compliance risk

Process Street is a Compliance Operations Platform that helps teams document policies in Docs, execute recurring work in Ops, and use Cora to monitor risks and improve processes over time.

For HIPAA work, the value is practical. Policies do not sit in a static document. They become workflows with owners, due dates, approvals, form fields, conditional logic, and activity history. That helps teams enforce the process and keep proof that the process happened.

For example, a breach reporting workflow can use dynamic due dates to keep the team inside notification windows. A privacy risk assessment can use conditional logic to route different tasks based on whether the work involves a covered entity, business associate, vendor, or internal team. A business associate agreement workflow can use approvals so legal, compliance, and operations sign off before work moves forward.

Process Street also connects documentation and execution. Docs gives teams a governed place for procedures, Ops turns those procedures into repeatable workflow runs, and Cora helps surface missed steps, bottlenecks, and policy drift before they become audit problems.

If you are building HIPAA policies and procedures from templates, connect them to a live operating system. Static documents help you start. Enforced workflows help you prove the work was done.

For a broader system view, see our guide to compliance automation software.

Check out this video for a quick introduction:

HIPAA policies and procedures templates: FAQs

What should HIPAA policies and procedures include?

At minimum, HIPAA policies and procedures should cover privacy practices, Security Rule safeguards, breach notification, workforce training, business associate agreements, risk assessments, access controls, documentation, and review cycles.

Are HIPAA templates enough for compliance?

No. Templates are starting points. You still need to customize them to your organization, run a risk analysis, train your workforce, assign owners, document completion, and get qualified legal or compliance review where needed.

How often should HIPAA policies be reviewed?

Review HIPAA policies on a defined schedule and whenever systems, vendors, regulations, incidents, or workflows change. The important part is to make review ownership explicit and keep evidence of each review.

Who needs a business associate agreement?

A business associate agreement is generally needed when a vendor or partner creates, receives, maintains, or transmits protected health information for a covered entity or another business associate. HHS provides sample business associate agreement provisions that teams can use as a reference.

Other useful resources for healthcare professionals

Use these resources to go deeper on HIPAA, healthcare workflows, and compliance operations:

• HHS breach reporting guidance
• HHS HIPAA Security Rule NPRM factsheet
• HHS sample business associate agreement provisions
• IBM Cost of a Data Breach Report 2025
• Hospital checklists
• SOAP note template
• ISO 13485 basics
• Process improvements toolkit

What do you think of these templates? Do you have any suggestions of checklists that could help you improve how you manage HIPAA compliance and the overall patient experience at your healthcare institution? Comment below and let us know!

The post 10 Top HIPAA Policies and Procedures Templates to Manage Compliance first appeared on Process Street | Compliance Operations Platform.