Privacy Policy Template for Small Practices

A Pennsylvania dental practice paid $140,000 to settle HIPAA violations, not for a data breach or ransomware attack, but for missing paperwork. The Office for Civil Rights (OCR) asked Shen Smiles for its written privacy policies, breach procedures, and training records. The practice had none of them.

Here's the template OCR expects you to have when it asks.

Purpose of the Template

This privacy policy template addresses the three documentation gaps that cost Shen Smiles its settlement: patient records request procedures, breach notification steps, and safeguard policies. You'll customize it with your practice's specific workflows, then use it to train staff and respond to OCR if a complaint arrives.

The template isn't a substitute for understanding your obligations under the Privacy Rule. It's the artifact that proves you've implemented them. When OCR investigates, it asks for written policies first. If you answer "None," the investigation expands.

Prerequisites

Before you customize this template, confirm you have:

• A designated Privacy Official (required under 45 CFR § 164.530(a)(1))
• Physical locations where you store paper and electronic records
• A list of staff roles that handle Protected Health Information (PHI)
• An email system or fax line patients use to request records
• A method for documenting staff training (even a spreadsheet works)

If you don't have a Privacy Official yet, assign one today. It can be the practice owner, office manager, or another staff member. The rule doesn't require a full-time position; it requires someone accountable.

The Template

Patient Records Request Procedure

Purpose: To fulfill patient rights under 45 CFR § 164.524 within required timeframes.

Procedure:

1. Recognition: Any written request for medical records, whether from the patient, their attorney, or sent by email, goes immediately to [Privacy Official name/title].

2. Logging: [Privacy Official] logs the request in [location: shared spreadsheet, paper log, practice management system] with: requester name, date received, records requested, and deadline (30 days from receipt).

3. Response timeline: Provide records within 30 days. If you need more time, send a written extension notice within the first 30 days explaining the delay. You get one 30-day extension, maximum.

4. Delivery: Ask the patient how they want to receive records (paper, email, portal, CD). If they request email, use [your HIPAA compliant email system or encrypted method]. Charge no more than reasonable cost-based fees for copying and postage.

5. Documentation: Mark the log when records are sent. Keep a copy of what you sent and any correspondence.

Responsible party: [Privacy Official name]

Training requirement: Front desk and clinical staff must recognize records requests and know to forward them immediately.

Breach Notification Procedure

Purpose: To comply with the Breach Notification Rule (45 CFR § 164.400-414) when PHI is impermissibly used or disclosed.

Trigger: A breach occurs when PHI is accessed, used, or disclosed in a way not permitted by the Privacy Rule, and the incident poses a significant risk of harm.

Procedure:

1. Report incidents: Any staff member who discovers missing records, lost devices, misdirected faxes, or unauthorized PHI access reports it to [Privacy Official] immediately.

2. Document the incident: Record what happened, what PHI was involved, how many patients were affected, when it occurred, and when you discovered it.

3. Risk assessment: [Privacy Official] assesses whether the incident meets the breach threshold using the four-factor test:

   • Nature and extent of PHI involved
   • Who impermissibly used or disclosed it
   • Whether PHI was actually acquired or viewed
   • Extent to which risk has been mitigated

4. Notification timeline if it's a breach:

   • Notify affected patients within 60 days of discovery
   • If 500+ patients: notify OCR and media within 60 days
   • If fewer than 500 patients: log it and report to OCR annually

5. Content of patient notice: Include what happened, what PHI was involved, what you're doing to investigate and prevent recurrence, and how patients can protect themselves.

Responsible party: [Privacy Official name]

Training requirement: All staff must know to report incidents immediately, not wait to see if they're serious.

PHI Safeguard Policy

Purpose: To reasonably safeguard PHI from impermissible use or disclosure under 45 CFR § 164.530(c).

Paper records:

• Store in locked file cabinets or locked rooms when not in use
• Never leave charts on counters, in clear boxes, or in unsecured areas overnight
• Keep all patient files at the practice; do not transport them to staff homes or other locations
• Shred records when disposing of them

Electronic records:

• Lock computers when you step away
• Use unique usernames and passwords for each staff member
• Log off the practice management system at the end of each day
• Do not email PHI unless using [your HIPAA compliant email system]

Minimum necessary:

• Access only the PHI you need for your job function
• Don't discuss patient cases in waiting areas or where others can overhear

Accountability:

• Staff who violate this policy face [disciplinary action: verbal warning, written warning, termination depending on severity]
• Document any violations and corrective actions taken

Responsible party: [Privacy Official name] enforces and updates this policy.

Training requirement: All staff review this policy during onboarding and annually.

Customization Instructions

Replace every bracketed placeholder with your practice's specific information:

• [Privacy Official name/title]: Insert the actual person's name and role
• [Location]: Name your physical log, software, or system (e.g., "the Records Request Log in the shared Google Sheet" or "the paper log in the front desk drawer")
• [Your HIPAA compliant email system]: Name your tool or method (e.g., "Paubox," "encrypted portal," or "our secure messaging system")
• [Disciplinary action]: Define your escalation path for policy violations

Add practice-specific details:

• If you have multiple locations, note where records are stored at each site
• If you use a specific practice management system, name it
• If certain roles (dental hygienists, billing staff, front desk) have different access levels, specify them

Don't add complexity you can't maintain. A two-page policy you actually follow beats a 40-page manual you've never opened.

Validation Steps

Once you've customized the template:

1. Test the records request procedure: Have a staff member role-play submitting a records request by email. Can your Privacy Official find it, log it, and know the deadline?

2. Walk through your storage areas: Are paper charts actually locked? Are electronic systems password-protected? Fix what you find before OCR does.

3. Train your staff: Schedule a 30-minute session where you read through each policy and answer questions. Document who attended and when.

4. Create your training log: Use a spreadsheet with columns for staff name, date trained, topics covered, and trainer signature. Update it every time you onboard someone or conduct annual refresher training.

5. Set a calendar reminder: Review and update these policies every 12 months, or sooner if your workflows change.

6. Store the policies where you can find them: Keep a printed copy in a binder labeled "HIPAA Policies" and a digital copy in a folder your Privacy Official can access in under two minutes.

If OCR sends you a letter tomorrow, you should be able to attach these policies to your response by the end of the week. That's the standard. Shen Smiles faced a potential $1.4 million penalty that OCR reduced by 90% due to the practice's size and rural location, and the final settlement was still $140,000. The discount is built into OCR's calculation method. It doesn't eliminate the cost of missing paperwork.

Print this template, fill in the brackets, train your team, and keep the documentation where you can prove it exists.