Toolkit · Healthcare

The HIPAA Compliance and Breach Response Toolkit

42 U.S.C. § 1320

Type
Toolkit
Jurisdiction
National
Date
2026-06-25
Topic
Healthcare

This toolkit contains the documents a covered entity or business associate actually needs on the day something happens. It supplies an access request letter for patients and a compliant response template for entities, an authorization form with the required core elements, and a subpoena response letter that demands the assurances the rule requires. It contains a four-factor breach risk assessment worksheet, individual and media notification letters, an HHS submission checklist, and an incident log. It supplies a business associate agreement outline with the required terms, a vendor intake questionnaire, a risk analysis scope template, an audit log review record, and a sanctions matrix. Each item notes the failure it prevents, and all must be conformed to the entity's policies and to the strictest applicable state law.

The HIPAA Compliance and Breach Response Toolkit

Healthcare > Health Information Privacy and HIPAA | Published 25 June 2026 - Updated 24 August 2026 | UpLaw - uplaw.us

What Is In This Toolkit

Sixteen documents. Use them with the checklist for sequence, the guide for the rules, and the article for orientation.

⚠️ Record the discovery date before anything else. Every deadline in a breach runs from it.

Tool 1 — Patient Access Request Letter

"Re: Request for records under the HIPAA right of access

Patient: [Name], DOB []. Medical record number, if known: [].

I am requesting a copy of my protected health information in the designated record set, for the period [] to [], including [clinic notes, test results, imaging reports, medication lists, billing records, and any records held by your business associates].

Format: please provide the records electronically, as [PDF / the electronic health record's standard export], delivered to [email / portal / the address below].

Third-party direction, if applicable: please send a copy to [Name, address], which I direct in writing.

This is a request under the HIPAA right of access, not a third-party authorization. I understand that you must act within thirty days, that any fee is limited to a reasonable cost-based fee that may not include search and retrieval time, and that access may not be conditioned on payment of an unrelated balance or on my stating a reason.

Please confirm the date you received this request. If any portion is denied, please state the specific basis in writing and whether the denial is subject to review.

[Signature, date, contact information.]"

Tool 2 — Entity Response Template

"Dear [Patient]:

We received your request for records on [date]. This letter confirms our response.

☐ Enclosed/transmitted: [description of the records provided, format, and date range]. ☐ Method: [secure portal / encrypted email / mail], sent [date]. ☐ Fee: $[], calculated as labor for copying $[], supplies $[], postage $[]. No search or retrieval time has been charged. ☐ Extension, if applicable: we require additional time because [reason] and will provide the records by [date not more than 30 additional days]. ☐ Partial denial, if applicable: we are not providing [category] because [ground]. This denial is [not reviewable / reviewable, and you may request review by a licensed health care professional who did not participate in this decision by contacting [name]]. ☐ Records held by others: [we have also requested records from [business associate] / records from [entity] must be requested directly].

Questions: [Privacy Officer, phone, email]. You may also file a complaint with our office or with the U.S. Department of Health and Human Services, Office for Civil Rights, without retaliation."

Tool 3 — Authorization Form Elements

Every element must be present or the authorization is invalid.

☐ Description of the information to be used or disclosed, specific and meaningful ☐ Name of the person or class authorized to make the use or disclosure ☐ Name of the person or class to whom the disclosure may be made ☐ Purpose of the use or disclosure ("at the request of the individual" is sufficient if the individual initiates it) ☐ Expiration date or event ☐ Signature of the individual and date; if signed by a personal representative, a description of their authority ☐ Statement of the right to revoke in writing, how to do so, and any exceptions ☐ Statement about conditioning treatment, payment, enrollment, or eligibility on signing ☐ Statement about redisclosure — that information disclosed may no longer be protected ☐ A copy provided to the individual ☐ Written in plain language ☐ Separate authorization for psychotherapy notes; not combined with other authorizations ☐ Statement of remuneration if the disclosure results in payment to the entity

Tool 4 — Subpoena Response Letter

"Re: Subpoena dated [] in [caption], Case No. []

We are in receipt of the above subpoena seeking records of [patient]. We are a covered entity under HIPAA and cannot produce protected health information in response to a subpoena that is not accompanied by a court order unless we receive satisfactory assurances as required by 45 C.F.R. part 164.

Please provide one of the following:

  1. A court order compelling disclosure, in which case we will produce what the order expressly authorizes;
  2. Written assurances, with supporting documentation, that you have made reasonable efforts to notify the individual, that the notice included sufficient information to permit an objection, and that either the time to object has passed with no objections or all objections have been resolved by the court; or
  3. Written assurances, with supporting documentation, that you have made reasonable efforts to secure a qualified protective order, or a copy of the entered order.

Please also note: [these records include substance use disorder treatment information protected by 42 C.F.R. part 2, which requires a court order meeting specific criteria / these records include [mental health / HIV / genetic] information subject to additional restrictions under [state] law].

Upon receipt of the required assurances we will produce the minimum necessary information responsive to the request. Please direct correspondence to [Privacy Officer]."

Tool 5 — Four-Factor Breach Risk Assessment

Complete for every impermissible use or disclosure, whether or not you conclude notice is required. The documentation is the defense.

Incident: [] Discovery date and time: [] Discovered by: [] Assessor: [] Date of assessment: [__]

Threshold questions ☐ Was the use or disclosure permitted by the Privacy Rule? If yes → not a breach; document and stop. ☐ Does an exception apply — unintentional good-faith workforce acquisition; inadvertent disclosure between authorized persons at the same entity; good-faith belief the recipient could not have retained the information? If yes → document and stop. ☐ Was the information encrypted to the specified standard? If yes → outside the definition; document and stop.

Factor 1 — Nature and extent of the information. What data elements? Direct identifiers? Diagnosis or treatment? Financial identifiers? Sensitive categories (mental health, substance use, HIV, genetic, reproductive)? Likelihood of re-identification?

Factor 2 — The unauthorized person. Who received or accessed it? Are they subject to HIPAA or another confidentiality obligation? Do they have the ability or motive to re-identify or misuse it?

Factor 3 — Whether the information was actually acquired or viewed. What do the logs show? Was the device recovered and forensically examined? Was the email opened? Is there evidence it was not accessed?

Factor 4 — Mitigation. Was the information returned or destroyed? Were assurances obtained and are they credible? Was access revoked, and when? What is the residual risk?

Conclusion: ☐ Low probability of compromise — no notification required (documented above). ☐ Breach — notification required.

Individuals affected: [] States of residence: [] Applicable deadlines: HIPAA 60 days from [discovery date]; state deadlines: [__].

Tool 6 — Individual Notification Letter

"[Date] Dear [Name]:

We are writing to notify you of an incident that may have involved your personal information.

What happened. On [date of discovery], we learned that [description]. Based on our investigation, the incident occurred on or about [date or range].

What information was involved. The information that may have been involved includes [list the specific data elements — name, date of birth, address, medical record number, diagnosis, treatment, insurance identifier, Social Security number]. [It did not include [__].]

What we are doing. We [contained the incident by __], [engaged a forensic firm], [reported the matter to [law enforcement / regulators]], and [describe remediation]. We have [reviewed and strengthened our safeguards by __].

What you can do. [Review statements and explanation-of-benefits notices for services you did not receive. Contact us about anything unfamiliar.] [We are offering [] months of credit monitoring and identity protection at no cost; enroll by [date] using code [].] [Consider placing a fraud alert or a credit freeze; instructions are enclosed.]

For more information. Call [toll-free number], available [hours], email [__], or write to [address]. You may also contact the U.S. Department of Health and Human Services, Office for Civil Rights.

We regret that this occurred and take the protection of your information seriously.

[Name, title]"

Tool 7 — Media Notice and HHS Submission Checklist

Media notice (required for breaches affecting more than 500 residents of a state, within 60 days of discovery): ☐ Prominent outlets serving the state or jurisdiction ☐ Same content elements as the individual notice ☐ Issued within the deadline, with a record of distribution

HHS submission: ☐ 500 or more individuals → submit within 60 days of discovery, separately for each breach ☐ Fewer than 500 → log and submit within 60 days after the end of the calendar year ☐ Information required: entity details; breach dates (occurrence and discovery); type of breach; location of the information; type of information; number of individuals; safeguards in place before the breach; and actions taken in response ☐ Retain the confirmation and a copy of the submission

Tool 8 — Incident Log

# Discovery date/time Discovered by Description Permitted? Exception? Encrypted? Four-factor conclusion Individuals States Notices sent HHS submitted Closed

Log every incident, including those that produce no notification. An empty log is not evidence of a clean year; it is evidence that nobody was assessing.

Tool 9 — Business Associate Agreement Outline

☐ Definitions incorporating the regulatory meanings ☐ Permitted uses and disclosures, stated specifically, including the associate's own management and administration and data aggregation if intended ☐ Prohibition on any other use or disclosure ☐ Safeguards, including compliance with the Security Rule for electronic protected health information ☐ Reporting of impermissible uses or disclosures, security incidents, and breaches, with a defined period and required content ☐ Subcontractors bound by the same restrictions ☐ Individual rights support: access, amendment, and accounting, with timeframes ☐ Availability to HHS of internal practices, books, and records ☐ Minimum necessary compliance ☐ Return or destruction at termination, or extension of protections if infeasible ☐ Termination for material breach ☐ Indemnification and insurance — not required by the rule but essential commercially ☐ Cooperation in breach investigation and notification, and allocation of notification costs ☐ Restrictions on de-identification and secondary use, including use for model training ☐ Data location, retention, and deletion terms ☐ Survival of confidentiality obligations

Tool 10 — Vendor Intake Questionnaire

Complete before any vendor touches data. This is the gate that catches the analytics script nobody classified.

  1. What service will you provide, and what data will you receive, create, maintain, or transmit?
  2. Will you receive or have access to identifiable health information? Describe the data elements.
  3. Are you acting on our behalf, or will you use the data for your own purposes? (A vendor using data for its own purposes cannot be a business associate, and the arrangement is impermissible.)
  4. Will you use the data to develop, train, or improve any product or model? If yes, describe.
  5. Where will the data be stored and processed, including any location outside the United States?
  6. Will you use subcontractors? Identify them and confirm flow-down agreements.
  7. Is data encrypted at rest and in transit? Describe the standards.
  8. Describe your access controls, authentication, and audit logging.
  9. Have you performed a security risk assessment? Provide the date and summary.
  10. Describe your incident response process and your breach notification commitment and timeframe.
  11. What are your retention and deletion practices, and what happens at termination?
  12. Have you had a reportable security incident in the last three years? Describe.
  13. Do you carry cyber liability insurance? Limits and carrier.
  14. Will you execute our business associate agreement without modification? If not, identify each requested change.

☐ Approved ☐ Approved with conditions: [] ☐ Rejected — reason: [] ☐ BAA executed [date] ☐ Added to inventory

Tool 11 — Risk Analysis Scope Template

The most frequently missing document in enforcement. Scope it fully or it does not count.

Systems and repositories: electronic health record; practice management and billing; imaging and PACS; laboratory; pharmacy; scheduling; patient portal; secure messaging; email; file shares; databases and data warehouses; analytics platforms; backup systems and media; archives; research systems; and any shadow system a department built.

Devices: workstations; laptops; tablets; mobile phones, including personally owned devices used for work; removable media; medical devices with storage or network connectivity; printers, copiers, and fax machines with hard drives; and cameras.

Locations: each facility; remote and home offices; storage sites; and vendor data centers.

Vendors: every business associate and subcontractor, with the data each holds.

Flows: how information enters, moves, and leaves — including interfaces, exports, reports, and any transmission to a third party from a website or application.

For each asset: data elements; volume; threats; existing controls; likelihood; impact; risk rating; and the remediation owner and date.

☐ Approved by [Security Official], date [] ☐ Next review [] ☐ Findings tracked in the risk management plan

Tool 12 — Audit Log Review Record

Review date Reviewer Systems Period covered Method (random sample / VIP flag / same-surname / high-volume user / self-lookup) Anomalies found Investigated? Outcome Sanctions applied

Standing checks worth automating: access to a record with no scheduled encounter or treatment relationship; access to records sharing the reviewer's surname or address; self-access; access to records of employees; access to records of publicly known individuals; and unusually high record volumes by one user.

Tool 13 — Sanctions Matrix

Consistency is the point. Inconsistent discipline is itself an enforcement finding.

Conduct First occurrence Repeat
Inadvertent misdirected fax or email, promptly reported Coaching and retraining Written warning
Failure to log out; unattended workstation Coaching Written warning
Sharing credentials Written warning Suspension or termination
Accessing a record with no treatment or business relationship (curiosity) Termination in most programs; at minimum final written warning Termination
Accessing a family member's or coworker's record Final written warning or termination Termination
Disclosure for personal gain or malice Termination and referral; potential criminal exposure under 42 U.S.C. § 1320d-6 —
Failure to report a known incident Written warning to termination Termination

☐ Document every application ☐ Apply the same standard regardless of seniority ☐ Retain records for six years

Tool 14 — Notice of Privacy Practices Content Checklist

☐ Header statement that the notice describes how information may be used and disclosed and how to get access ☐ Description and at least one example of uses for treatment, payment, and health care operations ☐ Description of other permitted uses and disclosures, including those required by law ☐ Statement that other uses require authorization and that authorizations may be revoked ☐ Separate statements for psychotherapy notes, marketing, and sale of information ☐ Individual rights: access, amendment, accounting, restrictions including the mandatory out-of-pocket restriction, confidential communications, paper copy, and breach notification ☐ The entity's duties, including to maintain privacy and abide by the notice's terms ☐ The right to complain to the entity and to HHS, and no retaliation ☐ Contact information for the privacy official ☐ Effective date, and a statement of the right to change the notice ☐ Provided at first service delivery, posted prominently and on the website, and acknowledgment sought from direct treatment patients

Tool 15 — Complaint Response Log

# Date received Complainant Nature Investigated by Findings Action taken Complainant informed Retaliation check Closed

Tool 16 — Authority Quick Card

Statute: 42 U.S.C. § 1320d · § 1320d-1 · § 1320d-2 · § 1320d-5 · § 1320d-6 · § 1320d-7 · § 1320d-8 HITECH: 42 U.S.C. § 17921 · § 17931 · § 17932 · § 17934 · § 17935 · § 17936 · § 17937 · § 17939 · § 17940 Regulations: 45 C.F.R. part 160 · part 162 · part 164 · part 170 · part 171 · part 46 Substance use: 42 U.S.C. § 290dd-2 · 42 C.F.R. part 2 Interoperability: 42 U.S.C. § 300jj-51 · § 300jj-52 Adjacent: 16 C.F.R. part 318 · 16 C.F.R. part 314 · 15 U.S.C. § 6801 · 42 U.S.C. § 12112 Cases: Whalen · NASA v. Nelson · Ferguson · Gonzaga

Tool 17 — Workforce One-Pager

Print it. Post it. It prevents most of what enforcement actually finds.

THE FIVE RULES

1. Only look at what you need for your job. Not your neighbor's chart. Not your coworker's. Not a family member's. Not a public figure's. Not your own, except through the patient portal. Every access is logged, we review the logs, and looking without a reason can cost you your job and can be a federal crime.

2. Share only the minimum necessary. When someone asks for information, give what the purpose requires and nothing more.

3. Verify before you send. Check the fax number, the email address, and the patient name every time. Misdirected records are our most common incident.

4. Protect the device. Lock your screen. Do not leave a laptop or phone in a car. Do not put patient information on a personal drive, a personal email account, or an unapproved application.

5. Report the same day. A misdirected fax, a lost phone, a suspicious email you clicked, a conversation overheard, a record you accessed by mistake — tell [Privacy Officer, phone, email] today. Reporting quickly is what keeps a small problem small. You will not be disciplined for promptly reporting your own honest mistake; you will be for hiding it.

Also: do not discuss patients in elevators, hallways, or on social media, even without names. Do not photograph a screen or a patient. Do not use an unapproved app or tool with patient information — ask first.

Questions: [Privacy Officer]. To report: [phone] or [email], any time.

Related Documents