Walk into any small healthcare practice and ask to see their HIPAA documentation. In my experience, you'll get one of three responses: a confident walk to a well-organized binder, a nervous shuffle toward a dusty folder that hasn't been touched in years, or — most commonly — a blank stare followed by "I think we have something somewhere."
Here's the thing: HIPAA compliance isn't just about checking boxes during an audit. These documents serve a real purpose. They protect your patients, guide your staff, and create a paper trail that proves you're taking privacy seriously. When something goes wrong — and in healthcare, things eventually go wrong — these documents become your first line of defense.
So what documents do you actually need? Let's break it down.
1. Risk Analysis Report
If there's one document that forms the foundation of your entire HIPAA compliance program, it's the risk analysis. This isn't optional — it's explicitly required by the HIPAA Security Rule, and it's the first thing auditors ask for.
A risk analysis identifies where your protected health information (PHI) lives, how it moves through your organization, and what threats could compromise it. Think of it as a comprehensive inventory of your vulnerabilities.
What it should include:
• An inventory of all systems that store, process, or transmit PHI
• Identification of potential threats (both human and environmental)
• Assessment of current security measures
• Likelihood and impact ratings for each identified risk
• Recommendations for addressing gaps
The biggest mistake I see practices make is treating this as a one-time exercise. Your risk analysis should be updated annually at minimum, or whenever you make significant changes to your systems or processes. Got a new EHR? Update the risk analysis. Opened a second location? Update the risk analysis. Started offering telehealth? You get the idea.
Many practices put this off because it sounds overwhelming. It doesn't have to be. A thorough risk analysis can be completed in under an hour if you're using the right tools and asking the right questions.
2. Privacy Policy
Your Privacy Policy is the internal document that governs how your organization handles PHI. It's different from your Notice of Privacy Practices (which we'll get to) — this one is for your team, not your patients.
A solid Privacy Policy covers the basics: what constitutes PHI, who can access it, how it should be stored, when it can be disclosed, and what happens when someone violates the rules. It should be written in plain language that your staff can actually understand and follow.
Key elements to include:
• Definition of PHI and examples relevant to your practice
• Permitted uses and disclosures
• Patient rights regarding their information
• Staff responsibilities and access levels
• Procedures for handling requests for PHI
• Consequences for policy violations
I've reviewed Privacy Policies that were clearly copied from a hospital template and make references to departments and procedures that don't exist in a small practice. Your policy needs to reflect how your organization actually operates. Generic templates might check a compliance box, but they won't help your staff make good decisions.
3. Security Policy
While your Privacy Policy focuses on the rules around PHI, your Security Policy focuses on the safeguards that protect it. This document addresses the technical, physical, and administrative measures you have in place to keep patient information secure.
For small practices, the Security Policy doesn't need to be a 50-page technical manual. But it does need to be specific enough that someone could follow it.
Areas to address:
• Password requirements and authentication procedures
• Workstation security (screen locks, positioning, access controls)
• Mobile device policies
• Network security measures
• Physical security (locks, access badges, visitor protocols)
• Data backup and recovery procedures
• Encryption standards
One thing that trips up a lot of practices: your Security Policy needs to align with your actual security setup. If your policy says you use encryption for all PHI but your staff is emailing patient information through regular Gmail, you've got a problem. Document what you actually do, then work on closing the gaps.
4. Notice of Privacy Practices (NPP)
This is the patient-facing document that explains how you use and protect their health information. HIPAA requires you to provide this notice to every patient and make a good faith effort to obtain written acknowledgment that they received it.
The Notice of Privacy Practices has specific content requirements mandated by HIPAA, including:
• How you may use and disclose their PHI
• Their rights regarding their health information
• Your legal duties to protect their privacy
• Who to contact with questions or complaints
• Effective date of the notice
You'll also need to post this notice in your office and on your website if you have one. When you make material changes to your privacy practices, you need to update the NPP and redistribute it.
A word of advice: don't just hand patients a dense legal document and ask them to sign. Take a moment to explain what it means. "This explains how we protect your private health information and what rights you have regarding your records." That small effort builds trust and demonstrates that you take their privacy seriously.
5. Business Associate Agreement (BAA)
If anyone outside your organization handles PHI on your behalf, you need a Business Associate Agreement with them. This includes your EHR vendor, billing company, IT support, cloud storage provider, shredding service, and even some cleaning companies if they have access to areas where PHI is present.
A BAA is a legal contract that ensures your business associates are also following HIPAA requirements. Without it, you're liable for their mistakes.
A proper BAA should include:
• Permitted uses and disclosures of PHI
• Requirements to implement appropriate safeguards
• Reporting requirements for breaches or security incidents
• Requirements for subcontractors
• Termination provisions
• Return or destruction of PHI upon termination
Here's a common pitfall: many vendors will offer to sign "their" BAA. That's fine, but read it carefully. Some vendor-provided BAAs are written heavily in their favor and may not adequately protect you. It's worth having a template that you're comfortable with and understand.
Also, keep track of your BAAs and their expiration dates. An expired or missing BAA is a compliance gap that auditors will catch — and that could leave you exposed if that vendor experiences a breach.
6. Incident Response Plan
When a security incident or potential breach occurs, you don't want to be figuring out what to do on the fly. An Incident Response Plan gives you a clear roadmap to follow when things go wrong.
The goal is to contain the incident, assess the damage, notify affected parties if necessary, and prevent it from happening again. Speed matters — both for limiting harm and for meeting HIPAA's breach notification requirements.
Your plan should address:
• How to identify and report a potential incident
• Who is responsible for leading the response
• Steps for containing and investigating the incident
• Criteria for determining if a breach occurred
• Notification procedures (patients, HHS, media if applicable)
• Documentation requirements
• Post-incident review and remediation
I recommend running through a tabletop exercise with your team at least once a year. Pick a realistic scenario — a lost laptop, a phishing email, a ransomware attack — and walk through how you'd respond. You'll quickly discover gaps in your plan.
7. Sanction Policy
HIPAA requires covered entities to have a sanction policy that applies appropriate consequences when workforce members violate privacy or security policies. This isn't about creating a punitive culture — it's about accountability.
Your Sanction Policy should be proportionate. Not every violation warrants termination. An employee who accidentally sends a fax to the wrong number needs retraining. An employee who deliberately snoops through celebrity medical records needs to be shown the door.
Elements to include:
• Types of violations covered
• Range of possible sanctions (verbal warning, written warning, suspension, termination)
• Factors considered in determining sanctions
• Process for investigating alleged violations
• Documentation requirements
• Non-retaliation protections for those who report violations
The key is consistency. If you terminate one employee for a violation but give another a pass for the same behavior, you've got problems — both from a compliance standpoint and a legal one.
8. Workforce Confidentiality Agreement
Every person in your organization who has access to PHI should sign a confidentiality agreement. This includes full-time employees, part-time staff, contractors, interns, and volunteers. If they can see patient information, they need to sign.
This document serves two purposes. First, it makes your privacy expectations crystal clear. Second, it creates documentation that the workforce member understood and agreed to those expectations. If someone later claims they didn't know they couldn't share patient information, you have a signed document that says otherwise.
A good confidentiality agreement covers:
• Definition of confidential information
• Obligations to protect that information
• Prohibition on unauthorized access or disclosure
• Obligations upon termination
• Acknowledgment of sanctions for violations
Make this part of your onboarding process. New hires should sign before they're given access to any systems containing PHI. And keep these agreements on file — you'll need them if there's ever a question about what an employee knew.
9. Access Control Policy
The principle of "minimum necessary" is central to HIPAA: workforce members should only have access to the PHI they need to do their jobs. Your Access Control Policy documents how you implement this principle.
In a small practice, it's tempting to give everyone access to everything. It's simpler, and you trust your team. But this creates unnecessary risk. The front desk staff doesn't need access to psychotherapy notes. The billing specialist doesn't need to see clinical images. Limiting access limits your exposure.
Your policy should address:
• Role-based access levels
• Process for granting access to new workforce members
• Process for modifying access when roles change
• Process for terminating access when someone leaves
• Periodic access reviews
• Emergency access procedures
Pay special attention to access termination. When an employee leaves — especially if it's not on good terms — their access to systems should be revoked immediately. Not tomorrow. Not after IT gets around to it. Immediately.
Bringing It All Together
Looking at this list, you might be feeling overwhelmed. Nine documents, each with multiple components, all needing to be customized to your specific practice. Where do you even start?
Here's the good news: you don't have to build these from scratch.
When I built hipaa.app, this was exactly the problem I wanted to solve. The platform walks you through a guided assessment of your organization — how you handle PHI, what systems you use, what safeguards you have in place — and generates these documents automatically. Not generic templates, but documents populated with your specific information.
Most practices complete the entire process in under 30 minutes and walk away with a complete documentation package: risk analysis, policies, BAA templates, incident response plan, and everything else on this list. All customized, all professional, all audit-ready.
But whether you use a tool like ours or build these documents yourself, the important thing is that you have them. HIPAA compliance isn't just about avoiding fines — though those can be substantial. It's about building a culture that takes patient privacy seriously. It's about having systems in place so that when something goes wrong, you know exactly what to do. It's about being able to look a patient in the eye and honestly say that you're protecting their most sensitive information.
These nine documents are your foundation. Get them in place, keep them updated, and train your team to follow them. That's what real compliance looks like.
Next Steps
If you're starting from scratch, don't try to tackle everything at once. Begin with the risk analysis — it will help you understand your current state and prioritize what needs attention. Then work through the policies one by one, making sure each one reflects your actual operations.
If you already have documentation but it's been sitting in a drawer for years, now's the time to dust it off. Review each document against your current operations. Update anything that's changed. Make sure your staff knows these policies exist and where to find them.
And if you want to streamline the whole process, create a free account at hipaa.app and see how quickly you can get compliant. No credit card required, no sales pitch — just the tools you need to protect your practice and your patients.
Your patients trust you with their health. Make sure you're worthy of their trust with their information too.