HIPAA Privacy Policies and Procedures

Required sections

• Designated privacy official and contact person for complaints (164.530(a))
• Permitted and required uses and disclosures, including treatment, payment and operations (164.502, 164.506)
• Authorization content and handling (164.508)
• Minimum necessary standard and role-based access classes (164.502(b), 164.514(d))
• Patient rights procedures: access within 30 days, amendment, accounting of disclosures, restriction requests, confidential communications (164.524 to 164.528)
• Notice of Privacy Practices distribution and acknowledgment of receipt (164.520)
• Business associate identification and agreement management (164.504(e))
• Complaint intake and handling (164.530(d))
• Workforce training and documentation of training (164.530(b))
• Sanctions for violations, applied and documented (164.530(e))
• Mitigation of harmful effects of a known violation (164.530(f))
• No retaliation and no waiver of rights (164.530(g), (h))
• Breach risk assessment and notification procedures (164.400 to 164.414)
• Documentation, version control and six-year retention (164.530(j))
• Statement on substance use disorder records if you hold Part 2 records (required in the NPP from Feb 16, 2026; policy-level cross reference is best practice)

What the examiner asks for