Downloads are your own copy to edit. How to open them in Word, Google Docs, or Pages
HIPAA process log
This is what an auditor or licensing board would ask for: evidence that you did what your policies say. Each time something HIPAA-relevant happens, add a row to the right register and a short dated entry to the narrative log, newest at the bottom. It takes 2 minutes and spares you rebuilding a year from memory.
Practice: [Practice Name]
Maintained by the Privacy and Security Officer. Retain at least 6 years (see the data retention policy).
Quick-reference registers
Annual training
| Year | Date completed | Source / format | Notes |
|---|---|---|---|
| [Year] |
Security risk analysis
| Year | Date completed | Document | Notes |
|---|---|---|---|
| [Year] |
Business associate agreements (BAAs)
| Vendor | Signed / accepted | Where the copy is filed | Status |
|---|---|---|---|
| [Electronic health record (EHR)] | |||
| [Email / cloud] |
Risk-accepted vendors (no BAA)
| Vendor | Date decided | Data allowed | Rationale |
|---|---|---|---|
Device disposal
| Date | Device | Serial | Method | Verified |
|---|---|---|---|---|
Complaints and incidents
| Date | Type | Summary | Resolved | Outcome |
|---|---|---|---|---|
Record destruction
| Date | Record type / date range | Count | Method | Verification |
|---|---|---|---|---|
Narrative log
[YYYY-MM-DD]
Example entry (replace with your own):
Started the practice's HIPAA program. Drafted the Security Risk Analysis, Policies & Procedures, and Data Retention Policy. Business associates: EHR (click-through BAA, effective on account creation; PDF saved); email provider (BAA to accept in the admin console); scheduling tool (no BAA offered; decision pending).
Next: accept email BAA; decide on scheduling tool; verify disk encryption and multi-factor authentication (MFA) on all devices and accounts; schedule annual training.
[YYYY-MM-DD]
Example entry:
Accepted the email provider's HIPAA BAA in the admin console; saved the agreement text and a screenshot of the acceptance. Confirmed the scheduling tool offers no BAA on any plan. Decision: keep it for consultation scheduling only, limited to name, email, phone, and appointment time; no clinical content, date of birth, or insurance. Logged as a risk acceptance in the register above and the risk analysis.
Verified disk encryption on laptop and MFA on EHR, email, bank, and password manager. Risk analysis finalized.