HIPAA Sample Documents
(Reviewed by NCHICA Board)

Please keep in mind, there is no warranty, written or implied, as to HIPAA compliance of these sample documents. The documents found here and elsewhere on the NCHICA website are for your own use and not for resale. Consult with your own legal and human resources departments for additional guidance. Special thanks to everyone who contributed sample documents. Click here to review the full disclaimer.

PRIVACY

Privacy & Security Implications of Meaningful Use for Health Care Providers (PDF), October 5, 2010
Amended and Restated Model Business Associate Agreement (Word format, 7 pages), February 1, 2010
This amended and restated agreement complies with requirements of the HITECH Act. Prepared by the Business Associate Agreement Task Force of the NCHICA Legal Workgroup.
Supplemental Materials (not reviewed):
- Notice to Covered Entities Under HIPAA Regarding New Requirements under the ARRA HITECH Act
- Template for Business Associate Alert and New Breach Notification Requirements
- Summary of Selected ARRA and HITECH Act (HIPAA 2) Provisions Related to Business Associates
Business Associate Agreement (Contract) incorporating provisions from the Final Security Rule published on February 20, 2003. (Word format, 6 pages), 4/2/03

Guidance for Identifying Designated Record Sets under HIPAA (PDF format, 14 pp.), 2/3/03

Notice of Privacy Practices (Word format, 18 pages), 3/18/03
This revised version includes an appendix with provisions for more stringent NC laws and regulations.

Analysis of the HIPAA Privacy Rule and Selected North Carolina Statutes, 12/11/01
Note: These are based on the Privacy Rule prior to the August 14, 2002 modifications.
Background and Explanation (PDF format, 5 pages)
Version A: Sorted by HIPAA Sections (PDF format, 83 pages)
Version B: Sorted by State Statute (PDF format, 84 pages)
Version C: Sorted by Summary Conclusion (PDF format, 83 pages)
Interpreting and Applying the HIPAA Preemption Provisions to State Privacy Law by Aimee N. Wall

Decision Tree for Use and Disclosure, 3/18/02
Note: This version is based on the Privacy Rule prior to the August 14, 2002 modifications.
Notes (PDF, 3 pages)
Decision Tree (PDF, 2 pages)

Safe Harbor De-Identification Chart (PDF format, 3 pages)
11/13/01

Research Topics:

Data Use Agreement for Limited Data Set (PDF, 4 pages)
3/6/03
Sample and Implementation Instructions for a Stand-alone Authorization for Use and Disclosure of Health Information for Research Purposes (PDF, 4 pages), 3/6/03
Guidelines for Using HIPAA Authorization Text as An Addendum to Informed Consent Forms (PDF, 3 pages)
3/6/03
Confidentiality and Use and Disclosure of Health Information for Research Purposes (PDF, 3 pages), 3/6/03
Using Protected Health Information (PHI) for Research Purposes (PDF format, 4 pages), 11/13/01
Training Clinical Research Professionals (PDF format, 3 pages), 11/13/01

SECURITY

Managing Sensitive Electronic Information (SEI) on Portable Devices and Removable Media (Word)
- Addendum to Vendor RFP Template for Meeting HIPAA Security Requirements for Portable Devices and Removable Media (Word, Legal Size)
Prepared by the Mobile Memory Task Force, NCHICA Privacy & Security Officials Workgroup, August 6, 2007

Considerations on Implementing A Wireless Network in the Healthcare Environment (PDF)
Prepared by the NCHICA Security Workgroup, January 2005

Addendum to Vendor RFP Template for Meeting HIPAA Security Requirements for Portable Devices and Removable Media (Word, Legal Size), August 6, 2007
NCHICA Vendor RFP Template for Meeting HIPAA Security Requirements (Word, 12 pages), October 2005

See also:
Internal Security Requirements Checklist (Word, not reviewed)

TRANSACTIONS

Direct Data Entry Principles (PDF, 3 pages), 3/5/03

HIPAA Sample Documents (Reviewed by NCHICA Board)

HIPAA Sample Documents
(Reviewed by NCHICA Board)