NOTE: Please review Disclaimer regarding Privacy Tools before adopting any of the tools.
	Mapping Your Flow of Patient Information
		Your answers to these questions will help you understand how patient information flows into, through and out of your organization. This understanding is a critical first step toward protecting the privacy and security of the information.
	Consent
	HHS has eliminated the requirement that providers obtain the consent of patients to use and disclose protected health information for treatment, payment and health care operations purposes. Obtaining consent is now optional; the Privacy regulation does not specify any format for obtaining optional consent.
	Authorization
	Checklist of requirements Sample Authorization to Use or Disclose Health Care Information
	Notice of Privacy Practices
	Checklist of requirements Sample Notice of Privacy Practices (generic) Sample Acknowledgment of Receipt of Privacy Notice Sample Documentation of Good Faith Effort to Obtain Acknowledgment
	Business Associates
	Identify your Business Associates: Explanation and Worksheet Business Associate Agreements Checklist of requirements HHS sample agreement MMIC Business Associate Agreement
	Minimum Necessary Use and Disclosure
	Worksheet: Workforce Access to Protected Health Information This chart will help you identify the categories of jobs in your organization and how access to patient information may need to be modified for each of those categories to meet the Minimum Necessary requirements of the HIPAA Privacy regulation.
	Accounting of Disclosures of PHI
	Checklist of requirements Sample Accounting form
	Policies and Procedures
	Suggested HIPAA Privacy Policies, Procedures and Documents
	DISCLAIMER:The tools included in this HIPAA Resource Center are intended only as samples to asist you in your HIPAA readiness activities. In using them, please be aware: The tools are based solely on the requirements of the federal Standards for Privacy of Individually Identifiable Health Information as implemented by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Except as otherwise noted, they do not address any unique requirements of state or other federal law or individual organizations' policies and procedures. Every healthcare organization must develop documents, policies and procedures that meet all releveant provisions of law, as well as reflect the actual practices of the organization. The tools have not been reviewed or approved by the Department of Health and Human Serivces (HHS). HHS has expressed its intent to issue further guidance on the Privacy regulation. The tools must be reviewed for necessary changes based on new information from HHS. The tools are not legal advice. Consult with a qualified attorney for legal advice on implementing the HIPAA Privacy regulation.
	Back to Top

Revised: March 2004