Sample binder
This is the binder the wizard generates for a fictional practice, Granite City Family Dental, a dental office with 9 staff in 412 2nd Street South, St. Cloud, MN 56301. Every document below is produced from that practice's answers; yours will read the same way with your names, systems and decisions.
The sample deliberately includes a few gaps (no MFA on the EHR, an unsigned vendor agreement) so you can see how the binder turns a gap into a risk-register item and a line on the remaining-steps checklist.
| # | Document | |
|---|---|---|
| 00 | Binder cover, index and how to use this binder | View |
| 01 | Entity profile and covered-entity / business-associate determination | View |
| 02 | Privacy Officer and Security Officer designation letters | View |
| 03 | Compliance program charter and annual calendar | View |
| 04 | Documentation and record retention policy | View |
| 05 | Sanction policy and sanction log | View |
| 06 | Notice of Privacy Practices | View |
| 07 | Uses and disclosures, minimum necessary and verification policy | View |
| 08 | Authorization form; marketing, fundraising and sale of PHI policy | View |
| 09 | Patient rights procedures, request forms and logs | View |
| 10 | Complaint handling and mitigation policy | View |
| 11 | Safeguards for PHI in all forms (paper, oral, fax, mail, text, social media) | View |
| 12 | Workforce training policy and roster | View |
| 13 | Security risk analysis report and risk management plan | View |
| 14 | Workforce security and information access management | View |
| 15 | Security awareness, password and authentication policy | View |
| 16 | Security incident response plan, ransomware playbook and incident log | View |
| 17 | Contingency plan: backup, disaster recovery, emergency mode, testing | View |
| 18 | Evaluation and annual review procedure | View |
| 19 | Business associate policy, agreement template and register | View |
| 20 | Physical safeguards: facility, workstation, device and media controls | View |
| 21 | Technical safeguards: access, audit, integrity, authentication, transmission | View |
| 22 | Breach notification policy, four-factor worksheet and notice letters | View |
| 23 | Minnesota Health Records Act supplement and consent form | View |
| 24 | Annual review meeting minutes and attestation | View |
| 25 | Registers and logs appendix | View |
| 26 | Confidentiality agreement and workforce acknowledgment forms | View |
| 27 | Remaining steps and information still needed | View |