Downloads are your own copy to edit. How to open them in Word, Google Docs, or Pages
HIPAA policies and procedures
Written for a solo, private-pay, telehealth-first practice in Washington or Rhode Island (or both). Replace everything in
[brackets]and delete any section that doesn't match how you practice: a policy describes the standard you'll be held to. With staff, an office, or insurance billing, several sections need expanding.
Practice: [Practice Name] Effective: [Date] Last reviewed: [Date] Reviewed by: [Your Name, credentials], Privacy & Security Officer Review cadence: Annual, and on any material change
Introduction
[Practice Name] is a solo private psychotherapy practice. The owner and sole workforce member is [Your Name, credentials], licensed in [Washington / Rhode Island] ([license number(s)]). It operates from [a home office in City, State / an office at address], providing [telehealth / in-person and telehealth] services to clients located in [Washington / Rhode Island]. It is fully out-of-network: clients pay directly, no insurance is billed, and superbills are provided on request.
This document works alongside:
- The Notice of Privacy Practices (client-facing; signed at intake)
- The Disclosure Statement / Informed Consent (client-facing; signed at intake)
- The Security Risk Analysis (annual)
- The Data Retention and Destruction Policy
- The AI Policy
- The HIPAA Process Log (running record of training, incidents, audits, and business associate agreements)
What HIPAA covers
- Privacy Rule: use and disclosure of Protected Health Information (PHI).
- Security Rule: administrative, physical, and technical safeguards for electronic PHI (ePHI).
- Breach Notification Rule: what to do when unsecured PHI is compromised.
The practice is a Covered Entity. Vendors that create, receive, store, or transmit PHI on the practice's behalf are Business Associates and must sign a Business Associate Agreement (BAA) before any PHI is shared with them.
Designated officer
Privacy and Security Officer: [Your Name], [start date]–present.
With no other workforce, the Officer is solely responsible for compliance, breach response, training, and documentation.
Business associates
| Business Associate | Service | BAA status |
|---|---|---|
| [Electronic health record (EHR), e.g. SimplePractice] | Clinical record, scheduling, billing, secure messaging, telehealth | [In force since date; how accepted] |
| [Email/cloud, e.g. Google Workspace] | Email, calendar, file storage | [In force since date; accepted in admin console] |
| [Other] |
Vendors used without a BAA, by documented decision. A vendor that won't sign a BAA is used only if no PHI goes in, or if what goes in is limited to the minimum necessary and the residual risk is accepted in writing (see vendors and business associate agreements). Record each one:
| Vendor | What it's used for | Data allowed | Rationale |
|---|---|---|---|
| [e.g. Calendly] | Consultation scheduling | Name, email, phone, and appointment time only; no clinical content, date of birth, or insurance | [Functional value; minimum-necessary limit; logged in Process Log on date] |
| [e.g. Bank / bookkeeping software] | Finances | No client names or clinical detail in memos or categories | Financial-only data; not PHI absent treatment context |
| [e.g. Apple iCloud / personal phone contacts] | Calling clients | First name, last initial, and phone only | Operational necessity; no clinical files in iCloud |
When a new vendor may touch PHI, a BAA is executed before any PHI is shared.
Privacy
PHI is individually identifiable health information in any form, including demographics, appointment information, and payment information when tied to care.
Notice of Privacy Practices
Every client receives and signs the Notice of Privacy Practices (NPP) via [EHR] before services begin. It describes permitted uses and disclosures and the client's rights (access, amendment, accounting of disclosures, restriction requests, and complaints). Current NPP effective: [date]. Material updates are re-signed.
Disclosure statement
Washington requires counselors to give clients a written disclosure statement; Rhode Island practices commonly use an equivalent informed-consent document. The Disclosure Statement covers the therapy process, confidentiality and its limits, electronic communication, telehealth, fees and cancellation, termination, complaints, and emergency resources. It is reviewed each calendar year.
Client-facing policies relevant to PHI:
- Email: [scheduling only / as described]. PHI is not sent by unencrypted email; clinical communication uses the EHR's secure messaging.
- Texting: [not used / used for scheduling only].
- Social media: clients are not connected on personal accounts.
- Telehealth: clients must be physically located in a state where the practitioner is licensed ([WA / RI]) at the time of session.
- Late cancellation: [policy].
Releases of information
A client may authorize release of PHI to a specific third party with a written Release of Information (ROI) through [EHR]. Each ROI names the recipient, purpose, and scope, expires [1 year from signature / on a stated date], and may be revoked at any time.
Consultation and supervision
In peer consultation or supervision, only the minimum necessary information is shared, and identifying information is excluded unless an ROI is in place.
Everyday privacy practices
Where sessions happen - Private room, door closed, white noise outside the door if needed. - Screens positioned so nothing is visible from doors or windows. - Screen locked whenever stepping away. - No sessions from public spaces or public Wi-Fi; use a virtual private network (VPN) if public Wi-Fi is ever unavoidable.
Talking and paper - PHI is not discussed where it can be overheard; use first names or initials by phone in non-private areas. - Paper is minimized. Handwritten notes are transcribed into the EHR and shredded.
Phone - [Describe: which phone, voicemail handling, whether texting is used.]
Devices - Passcode/biometric unlock; auto-lock within 5 minutes. - Full-disk encryption on (FileVault on Mac, BitLocker on Windows; phones encrypt by default with a passcode). - Find My / remote wipe enabled. - PHI documents are not downloaded locally; if one must be (e.g. to sign), it is deleted and the trash emptied. - Before selling, recycling, or giving away a device: factory erase, and log it in the Process Log.
Privacy complaints
A client may complain to the Privacy and Security Officer ([email], [phone]) or to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (hhs.gov/ocr/complaints).
Procedure:
- Log the complaint in the HIPAA Process Log (date, complainant, and nature).
- Acknowledge in writing within 5 business days.
- Investigate and reach a resolution or response plan within 30 days.
- Communicate the resolution in writing.
- Document corrective action in the Process Log.
- No retaliation, ever.
Complaint records are retained at least 6 years.
Security
Risk management
The framework is this document (reviewed annually), an annual Security Risk Analysis, the HIPAA Process Log, and annual self-training.
Administrative safeguards (45 CFR §164.308)
- Security management: annual risk analysis; risks tracked to remediation.
- Assigned responsibility: [Your Name] is Privacy and Security Officer.
- Workforce security / access management: not applicable while the practitioner works alone. Revisit before engaging any contractor or hire.
- Training: annual self-training, logged.
- Incident procedures: see Breach notification.
- Contingency plan: see below.
- Evaluation: annual risk analysis, plus on any material change.
- BAAs: required before PHI is shared with any vendor.
Physical safeguards (§164.310)
- Facility: [e.g. home office in a locked residence; office door closed during sessions and locked when unattended].
- Workstation use: work devices are sole-use; household members do not have accounts on them.
- Workstation security: auto-lock ≤ 5 minutes; disk encryption on.
- Device and media: no USB drives or external disks for PHI; devices erased before disposal.
Technical safeguards (§164.312)
- Access control: unique accounts; multi-factor authentication (MFA) on the EHR, email, device account (Apple ID / Microsoft), and password manager.
- Audit controls: EHR and email provider audit logs exist; spot-checked [quarterly].
- Integrity: rely on EHR version history and email-provider restore.
- Authentication: strong unique passwords in a password manager, plus MFA.
- Transmission: PHI moves only through the EHR (encrypted) or BAA-covered email; never plain SMS or personal email.
Breach notification
On any known or suspected impermissible use or disclosure of unsecured PHI:
- Contain. Stop it (revoke access, recall or request deletion of a misdirected message) and write down what happened.
- Assess with HIPAA's four factors: - the nature and extent of the PHI (identifiers, likelihood of re-identification); - who received it; - whether it was actually acquired or viewed; - how far the risk has been mitigated.
- Decide. If the probability of compromise is low, document the reasoning; notification may not be required. Otherwise treat it as a breach.
- Notify if it is a breach: - affected individuals, in writing, without unreasonable delay and within 60 days of discovery; - HHS: fewer than 500 people → log and report within 60 days of the end of the calendar year; 500 or more → notify HHS and prominent media within 60 days. - Both Washington and Rhode Island have their own data-breach notification laws, with their own timelines and Attorney General reporting. Check current requirements before notifying.
- Document everything in the Process Log.
- Get advice from an attorney or your malpractice carrier's risk-management line when severity warrants.
Contingency plan
Business Associates provide primary storage and backup of ePHI.
- Lost or stolen device: remote wipe; replacement device signs in; no local-only PHI is lost.
- Internet outage: reschedule, or run the session over phone hotspot.
- EHR outage: contact clients by email for scheduling only (no PHI); write any notes without identifiers and enter them when service returns.
- Email provider outage: EHR messaging covers scheduling.
- Practitioner incapacity or death: see the Professional Will, which names a backup clinician to notify clients and manage records.
Sanctions
Not applicable while there is no workforce. The practitioner documents any self-identified lapse in the Process Log, does a root-cause review, and updates this document or training as needed. Add a sanctions policy before engaging anyone else.
Training
Annual HIPAA Privacy and Security training, logged with date and source. At minimum: Privacy Rule basics, Security Rule basics, a re-read of this document, breach recognition and response, and recent HHS enforcement or guidance. After any material change to this document, re-read it in full and log the review.
Documentation
Retain for at least 6 years from creation or last effective date (other retention periods are in the data retention policy):
- This document and all prior versions
- Security Risk Analyses
- Notice of Privacy Practices and Disclosure Statement (all versions)
- Signed BAAs
- HIPAA Process Log
- Complaint and breach records, including four-factor assessments
- Data Retention and AI policies
- Device disposal records
Storage: compliance documents at [location]; client PHI in [EHR] only; administrative records that may reference clients in [BAA-covered email/drive].
Template shared in the Private Practice Toolkit. Not legal, tax, clinical, or compliance advice. Review it against current federal and Washington requirements, and consider having an attorney or your malpractice carrier's risk-management service look it over.