Granite City Family Dental — HIPAA Compliance Binder 2026
Prepared for Granite City Family Dental, P.A. with the CRU Technologies HIPAA Binder Builder. Generated October 23, 2026. Policy set version 1.0, effective November 1, 2026.
How to use this binder
- Read the Remaining Steps document first; it lists what is still missing.
- Have the owner sign the officer designation letters, the policy approval page and the annual review attestation.
- Give every workforce member the acknowledgment forms to sign; file them behind the training roster.
- File signed business associate agreements behind the register.
- Keep the logs current through the year; at your annual review month, renew the binder and record the meeting minutes.
- Keep every edition for six years.
Contents
| # | Document | Authority |
|---|---|---|
| 00 | Binder cover, index and how to use this binder | — |
| 01 | Entity profile and covered-entity / business-associate determination | 45 CFR 160.103; 164.105 |
| 02 | Privacy Officer and Security Officer designation letters | 164.530(a); 164.308(a)(2) |
| 03 | Compliance program charter and annual calendar | 164.308(a)(8); 164.316 |
| 04 | Documentation and record retention policy | 164.316(b)(2); 164.530(j) |
| 05 | Sanction policy and sanction log | 164.308(a)(1)(ii)(C); 164.530(e) |
| 06 | Notice of Privacy Practices | 164.520 |
| 07 | Uses and disclosures, minimum necessary and verification policy | 164.502–164.514 |
| 08 | Authorization form; marketing, fundraising and sale of PHI policy | 164.508; 164.514(f) |
| 09 | Patient rights procedures, request forms and logs | 164.522–164.528 |
| 10 | Complaint handling and mitigation policy | 164.530(d), (f) |
| 11 | Safeguards for PHI in all forms (paper, oral, fax, mail, text, social media) | 164.530(c) |
| 12 | Workforce training policy and roster | 164.530(b); 164.308(a)(5) |
| 13 | Security risk analysis report and risk management plan | 164.308(a)(1)(ii)(A)-(B) |
| 14 | Workforce security and information access management | 164.308(a)(3)-(4) |
| 15 | Security awareness, password and authentication policy | 164.308(a)(5); 164.312(d) |
| 16 | Security incident response plan, ransomware playbook and incident log | 164.308(a)(6) |
| 17 | Contingency plan: backup, disaster recovery, emergency mode, testing | 164.308(a)(7) |
| 18 | Evaluation and annual review procedure | 164.308(a)(8) |
| 19 | Business associate policy, agreement template and register | 164.504(e); 164.308(b); 164.314(a) |
| 20 | Physical safeguards: facility, workstation, device and media controls | 164.310 |
| 21 | Technical safeguards: access, audit, integrity, authentication, transmission | 164.312 |
| 22 | Breach notification policy, four-factor worksheet and notice letters | 164.400–164.414; Minn. Stat. 325E.61 |
| 23 | Minnesota Health Records Act supplement and consent form | Minn. Stat. 144.291–144.298 |
| 24 | Annual review meeting minutes and attestation | 164.308(a)(8); 164.316(b)(2)(iii) |
| 25 | Registers and logs appendix | 164.316(b) |
| 26 | Confidentiality agreement and workforce acknowledgment forms | 164.530(b), (e) |
| 27 | Remaining steps and information still needed | — |
| 28 | HIPAA requirements matrix: every standard, where it is met, what is left | All of the above |
Officers
Privacy Officer: Janelle Okafor (Office Manager)
Security Officer: Janelle Okafor (Office Manager)
Prepared with the assistance of CRU Technologies, 320-309-8645, [email protected].