# HIPAA Privacy Rule Compliance Checklist — Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | [Covered Entity Name] |
| Type | [ ] Healthcare Provider [ ] Health Plan [ ] Healthcare Clearinghouse |
| Privacy Officer | [Name, Title] |
| Assessment Date | [YYYY-MM-DD] |
| Assessor | [Name, Title] |

---

## Section 1: Notice of Privacy Practices (§164.520)

- [ ] NPP is current and reflects all actual PHI uses and disclosures
- [ ] NPP includes all required content elements:
  - [ ] Description of how PHI may be used and disclosed
  - [ ] Description of individual's rights regarding PHI
  - [ ] Covered entity's legal duties regarding PHI
  - [ ] Contact information for further information and complaints
  - [ ] Effective date
- [ ] NPP distributed at first service delivery (providers with direct treatment relationship)
- [ ] Good faith effort to obtain written acknowledgment of NPP receipt
- [ ] NPP posted in clear and prominent location in facility
- [ ] NPP posted on website (if applicable)
- [ ] NPP available to anyone who requests a copy
- [ ] Material revisions distributed within 60 days (health plans)

**Findings**: _______________________________________________

---

## Section 2: Individual Rights

### Right of Access (§164.524)
- [ ] Written process for handling access requests
- [ ] Requests acted upon within 30 days (60 days with extension)
- [ ] PHI provided in requested format if readily producible
- [ ] Fees limited to reasonable, cost-based amounts
- [ ] Denial process compliant (written, basis stated, appeal information provided)
- [ ] Third-party direction honored (individual directs PHI to third party in writing)

### Right to Amend (§164.526)
- [ ] Written process for amendment requests
- [ ] Acted upon within 60 days
- [ ] If denied: written denial with basis, right to submit disagreement statement

### Right to Accounting of Disclosures (§164.528)
- [ ] Accounting covers 6-year period
- [ ] Includes required elements (date, recipient, description, purpose)
- [ ] Excludes appropriate categories (TPO, to individual, per authorization)
- [ ] Provided within 60 days of request (90 days with extension)

### Right to Request Restrictions (§164.522(a))
- [ ] Process to receive and evaluate restriction requests
- [ ] Mandatory restriction honored (out-of-pocket full payment — no disclosure to health plan)
- [ ] Agreed-upon restrictions tracked and enforced

### Right to Confidential Communications (§164.522(b))
- [ ] Process for confidential communications requests
- [ ] Reasonable requests accommodated (alternative address, alternative means)

**Findings**: _______________________________________________

---

## Section 3: Minimum Necessary Standard (§164.502(b), §164.514(d))

- [ ] Role-based access policies define PHI categories per workforce class
- [ ] Access limited to minimum necessary PHI for each role
- [ ] Standard PHI sets for routine, recurring disclosures documented
- [ ] Case-by-case review criteria for non-routine disclosures
- [ ] Reasonable reliance doctrine applied and documented
- [ ] Minimum necessary exceptions properly identified and applied (treatment, to individual, authorization, HHS, required by law)

**Findings**: _______________________________________________

---

## Section 4: Uses and Disclosures

### TPO (§164.506)
- [ ] TPO disclosures limited to minimum necessary (except treatment)
- [ ] Healthcare operations meet §164.501 definition

### Authorization (§164.508)
- [ ] Authorization form contains all required elements
- [ ] Psychotherapy notes authorization separate
- [ ] Marketing authorization specific
- [ ] Sale of PHI authorization includes remuneration disclosure
- [ ] Authorization tracking system (active, expired, revoked)
- [ ] Revocation process documented

### Public Interest (§164.512)
- [ ] Policies for each applicable §164.512 category
- [ ] Minimum necessary applied to public interest disclosures
- [ ] Documentation maintained for each disclosure

**Findings**: _______________________________________________

---

## Section 5: Administrative Requirements (§164.530)

- [ ] Privacy Officer designated
- [ ] Contact person designated for complaints
- [ ] Privacy policies and procedures documented
- [ ] All workforce members trained on privacy policies
- [ ] Training documentation retained
- [ ] Administrative, technical, and physical safeguards for PHI
- [ ] Complaint process documented and accessible
- [ ] No retaliation or waiver policies in place
- [ ] Sanction policy for workforce privacy violations
- [ ] Documentation retained for 6 years

**Findings**: _______________________________________________

---

## Section 6: Business Associates (§164.502(e), §164.504(e))

- [ ] All BA relationships identified and inventoried
- [ ] BAAs executed with all business associates before PHI access
- [ ] BAAs contain all required provisions:
  - [ ] Permitted/required uses and disclosures
  - [ ] Prohibition on unauthorized use
  - [ ] Appropriate safeguards requirement
  - [ ] Breach reporting
  - [ ] Subcontractor flow-down
  - [ ] Access, amendment, accounting support
  - [ ] HHS access to books and records
  - [ ] Return/destruction of PHI at termination
- [ ] BA compliance monitored (annual assessment, SOC 2 review)
- [ ] BAA breach remediation process documented

**Findings**: _______________________________________________

---

## Assessment Summary

| Area | Compliant | Gaps | Risk Level |
|------|-----------|------|-----------|
| Notice of Privacy Practices | /8 | | |
| Individual Rights | /14 | | |
| Minimum Necessary | /6 | | |
| Uses and Disclosures | /8 | | |
| Administrative Requirements | /10 | | |
| Business Associates | /6 | | |
| **Total** | **/52** | | |

## Remediation Plan

| Gap | Priority | Responsible Party | Target Date | Status |
|-----|----------|------------------|------------|--------|
| | | | | |

## Approval

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Privacy Officer | | | |
| Compliance Director | | | |
| Chief Executive | | | |