Compliance program charter and annual calendar
Granite City Family Dental — HIPAA compliance program charter. Version 1.0. Effective November 1, 2026. Approved by Dr. Maria Lindqvist, Owner.
Authority: 45 CFR 164.308(a)(8) (evaluation); 45 CFR 164.316(b)(2)(iii) (periodic review of documentation); 45 CFR 164.530(i) (policies and procedures).
1. Purpose and commitment
Granite City Family Dental, P.A. runs a written HIPAA compliance program so that the confidentiality, integrity and availability of its patients' health information are protected every day, not only when an auditor asks. The owner, Dr. Maria Lindqvist, Owner and Dentist, is accountable for the program. The Privacy Officer, Janelle Okafor, and the Security Officer, Janelle Okafor, run it. Every workforce member — employees, owners, providers, contractors, volunteers and students — is bound by it.
The program has three parts: the policies in this binder, the registers and logs that prove the policies are followed, and the annual cycle below that keeps both current.
2. Compliance committee
The committee meets at least once a year in October to carry out the evaluation required by 164.308(a)(8), and at any other time the Privacy or Security Officer calls a meeting (after an incident, a breach, an OCR inquiry, a change in law, or a major system change). The Security Officer also reports the status of open risk register items to the owner every quarter.
| Name | Role |
|---|---|
| Dr. Maria Lindqvist | Owner |
| Janelle Okafor | Privacy and Security Officer |
| CRU Technologies | IT provider |
A quorum is the owner (or the owner's delegate) plus at least one of the two officers. Decisions are recorded in the annual review minutes. The IT provider, CRU Technologies, attends or submits a written report on the technical controls.
3. Responsibilities
- Owner: approves policies and sanctions, funds remediation, signs the residual-risk acceptance and the annual attestation.
- Privacy Officer: owns documents 04 through 12 of this binder, patient rights, complaints, the Notice, training records and the business associate register.
- Security Officer: owns the risk analysis, risk management plan, workforce security, incident response, contingency plan, physical and technical safeguards and the device inventory.
- Policy approver (Dr. Maria Lindqvist, Owner): signs each policy version; no policy is in force until signed.
- Every workforce member: follows the policies, completes training on time, reports incidents and suspected violations the same day.
4. Annual compliance calendar
Annual items fall in October unless a date is fixed by law. "Officer" means the Privacy or Security Officer as marked.
| Activity | Rule basis | When | Owner |
|---|---|---|---|
| Risk analysis update (all ePHI, all locations, all systems) | 164.308(a)(1)(ii)(A) | Annually in October, and after any new system, vendor, location or incident | Security Officer |
| Risk management plan status check | 164.308(a)(1)(ii)(B) | Quarterly; full review annually | Security Officer |
| Evaluation (annual review meeting, minutes, attestation) | 164.308(a)(8) | Annually in October | Owner and both officers |
| Policy and procedure review; re-sign approval page; new policy version | 164.316(b)(2)(iii); 164.530(i) | Annually, and when law or practice changes | Policy approver |
| Workforce training: new hires within 30 days; refresher annually | 164.530(b); 164.308(a)(5) | Annually; on hire; after material policy change | Privacy Officer; tracked by Janelle Okafor |
| Security reminders (newsletter, huddle topic, poster) | 164.308(a)(5)(ii)(A) | Quarterly | Security Officer |
| Simulated phishing | 164.308(a)(5)(ii)(A) | Not yet in place — add to the risk register | Security Officer |
| Business associate register review; chase missing or expiring BAAs | 164.504(e); 164.308(b) | Annually; on any new vendor | Janelle Okafor |
| Backup restore test and contingency plan test | 164.308(a)(7)(ii)(D) | Annually; after any backup change | Security Officer with CRU Technologies |
| Device and media inventory reconciliation; disposal certificates filed | 164.310(d)(2)(iii) | Annually; on every purchase or disposal | Security Officer |
| User access review and certification | 164.308(a)(4)(ii)(C) | Quarterly; annual certification | Security Officer |
| Information system activity (log) review | 164.308(a)(1)(ii)(D) | Monthly; annual summary | CRU Technologies with Janelle Okafor |
| Sanction log, complaint log, access log, incident log and breach log review | 164.530(d), (e); 164.524; 164.308(a)(6) | Annually | Privacy Officer |
| Under-500 breach report to HHS for the prior calendar year | 164.408(c) | By March 1 each year | Janelle Okafor |
| Notice of Privacy Practices re-issue | 164.520(b)(3), (c) | On any material change | Privacy Officer |
| Facility walkthrough at each location | 164.310 | Annually; on move or remodel | Security Officer |
| Privacy and Security Officer designations re-confirmed | 164.530(a); 164.308(a)(2) | Annually at the review meeting | Owner |
| Minnesota consent form and copy-fee schedule checked against Minn. Stat. 144.292–144.293 | Minn. Stat. 144.292; 144.293 | Annually | Privacy Officer |
| Cyber liability insurance renewal and requirements check | Good practice | Annually | Owner |
5. Policy index
This binder contains the following documents. Each carries the same version number and effective date unless its own approval page says otherwise. The number is the tab in the printed binder.
- 00 — Binder cover, index and how to use this binder
- 01 — Entity profile and covered-entity / business-associate determination
- 02 — Privacy Officer and Security Officer designation letters
- 03 — Compliance program charter and annual calendar
- 04 — Documentation and record retention policy
- 05 — Sanction policy and sanction log
- 06 — Notice of Privacy Practices
- 07 — Uses and disclosures, minimum necessary and verification policy
- 08 — Authorization form; marketing, fundraising and sale of PHI policy
- 09 — Patient rights procedures, request forms and logs
- 10 — Complaint handling and mitigation policy
- 11 — Safeguards for PHI in all forms (paper, oral, fax, mail, text, social media)
- 12 — Workforce training policy and roster
- 13 — Security risk analysis report and risk management plan
- 14 — Workforce security and information access management
- 15 — Security awareness, password and authentication policy
- 16 — Security incident response plan, ransomware playbook and incident log
- 17 — Contingency plan: backup, disaster recovery, emergency mode, testing
- 18 — Evaluation and annual review procedure
- 19 — Business associate policy, agreement template and register
- 20 — Physical safeguards: facility, workstation, device and media controls
- 21 — Technical safeguards: access, audit, integrity, authentication, transmission
- 22 — Breach notification policy, four-factor worksheet and notice letters
- 23 — Minnesota Health Records Act supplement and consent form
- 24 — Annual review meeting minutes and attestation
- 25 — Registers and logs appendix
- 26 — Confidentiality agreement and workforce acknowledgment forms
- 27 — Remaining steps and information still needed
6. How the program is evaluated
The annual review follows the Evaluation and Annual Review Procedure (document 18) and records its results in the minutes (document 24). At a minimum the committee re-confirms the officers; receives the risk analysis and the count of risks closed, open and accepted; samples the controls (MFA, encryption, restore test, access review, log review); reviews incidents, patient-rights metrics, training completion, workforce changes, business associates, the device inventory and sanctions; approves policy changes; notes regulatory changes; and sets next year's actions with owners and dates. The owner then signs the attestation that documentation is retained for six years.
Regulatory watch for 2026: the proposed update to the HIPAA Security Rule (published January 6, 2025) is not final; its target for final action is July 2027. This binder is built to the current rule. When the update is final, the committee expects mandatory multifactor authentication, encryption at rest and in transit, a written asset inventory and network map, a 72-hour restore standard and an annual compliance audit, and will update the calendar above.
7. Approval
This charter is approved and takes effect on November 1, 2026.
Owner / principal: Dr. Maria Lindqvist, Owner and Dentist
Signature: ______________________________ Date: ______________
Policy approver: Dr. Maria Lindqvist, Owner
Signature: ______________________________ Date: ______________