# HIPAA process log

> **This is what an auditor or licensing board would ask for: evidence that you did what your policies say.** Each time something HIPAA-relevant happens, add a row to the right register and a short dated entry to the narrative log, newest at the bottom. It takes 2 minutes and spares you rebuilding a year from memory.

**Practice:** [Practice Name]

Maintained by the Privacy and Security Officer. Retain at least 6 years (see the [data retention policy](https://toolkit.marcusberley.com/data-retention-policy/)).

---

## Quick-reference registers

### Annual training

| Year | Date completed | Source / format | Notes |
|---|---|---|---|
| [Year] | | | |

### Security risk analysis

| Year | Date completed | Document | Notes |
|---|---|---|---|
| [Year] | | | |

### Business associate agreements (BAAs)

| Vendor | Signed / accepted | Where the copy is filed | Status |
|---|---|---|---|
| [Electronic health record (EHR)] | | | |
| [Email / cloud] | | | |

### Risk-accepted vendors (no BAA)

| Vendor | Date decided | Data allowed | Rationale |
|---|---|---|---|
| | | | |

### Device disposal

| Date | Device | Serial | Method | Verified |
|---|---|---|---|---|
| | | | | |

### Complaints and incidents

| Date | Type | Summary | Resolved | Outcome |
|---|---|---|---|---|
| | | | | |

### Record destruction

| Date | Record type / date range | Count | Method | Verification |
|---|---|---|---|---|
| | | | | |

---

## Narrative log

### [YYYY-MM-DD]

*Example entry (replace with your own):*

Started the practice's HIPAA program. Drafted the Security Risk Analysis, Policies & Procedures, and Data Retention Policy. Business associates: EHR (click-through BAA, effective on account creation; PDF saved); email provider (BAA to accept in the admin console); scheduling tool (no BAA offered; decision pending).

Next: accept email BAA; decide on scheduling tool; verify disk encryption and multi-factor authentication (MFA) on all devices and accounts; schedule annual training.

---

### [YYYY-MM-DD]

*Example entry:*

Accepted the email provider's HIPAA BAA in the admin console; saved the agreement text and a screenshot of the acceptance. Confirmed the scheduling tool offers no BAA on any plan. **Decision:** keep it for consultation scheduling only, limited to name, email, phone, and appointment time; no clinical content, date of birth, or insurance. Logged as a risk acceptance in the register above and the risk analysis.

Verified disk encryption on laptop and MFA on EHR, email, bank, and password manager. Risk analysis finalized.

---