HIPAA Privacy Policies & Procedures

All of the policies below have been approved and may not be altered in any manner, except to customize the Procedure section for the respective departmental area. To customize the Procedure section, an attachment must be created and appended to the department's internal policy. The Procedure section is dependent upon each department's unique operating structure and should be customized accordingly.

POLICY NAME	POLICY PDF	FORM / ATTACHMENT
Accounting of Disclosures		Patient Request Accounting of Disclosures Form Accounting of Disclosures HIM Templates
Alcohol and Substance Abuse Information (Special Category)*		Alcohol and Substance Abuse NOP
Business Associate Agreements		BAA Template (PDF) SUNY as Covered Entity (Word Template) SUNY as BAA Template
Compliance and Enforcement
Compliance (& HIPAA) Training	Currently under revision	Course Requirement Matrix
Covered Entity Designation
De-Identification of Information
Designated Record Set
Facility Directory		Facility Directory Form
Faxing Patient Information		Fax Cover Page
Fundraising Activities		Fundraising Opt-out Form
HIV Related Information (Special Category)*		NOP For HIV Info
Marketing Activities		Marketing Authorization Form
Mental Health Information (Special Category)*		NOP for Mental Health Info
Minimum Necessary Guidelines
Notice of Privacy Practices*		NOP Acknowledgement Form
Patient Requests for Access		HIPAA Authorization Form Patient Access HIM Templates
Patient Requests for Additional Privacy Protections		Out of Pocket Restriction Form Patient Requests Additional Privacy Form / Template
Patient Requests for Amendment		Patient Requests Amendment Form Patient Requests Amendment HIM Templates
Personal Representatives
Privacy of Psychotherapy Notes		Psychotherapy Notes Authorization Form
Privacy Rights of Minors
Quality Assurance
Safeguards for Protected Health Information
Sale of Protected Health Information		Patient Authorization for Sale of PHI
Short Notice of Privacy for Healthcare Events		Short NOP with Patient Receipt Log
Student Immunization Records
Telephone Requests for Patient Information
Use of Limited Data Sets		Data Use Agreement Template
Use & Disclosure for Research Purposes		Certification for Reviews Preparatory to Research Certification for PHI of Decedents HIPAA Waiver of Authorization Subject Recruitment Authorization - Internal Authorization for Recruitment Contact Subject Recruitment Authorization - Internal Verbal Authorization for Recruitment Contact Subject Recruitment Authorization - External Authorization for Recruitment Contact Sponsor Contract Privacy Provisions
Uses & Disclosures for Treatment, Payment & Healthcare Operations		Provider Request for Patient Information
Uses & Disclosures Not Requiring Patient Authorization
Uses & Disclosures of Decedent Information
Uses & Disclosures Requiring Patient Authorization		HIPAA Authorization Form
Uses & Disclosures to Individuals Involved in Care & for Notification Purposes
Verification of Identity
Workforce Confidentiality		Workforce Confidentiality Attestation

*For translated versions of this notice, please visit
Patient Policy