CRU TechnologiesHIPAA Binder

← All sample documents  ·  Print

Sample document for a fictional practice. Yours is written from your own answers. Get my quote

Safeguards for PHI in all forms (paper, oral, fax, mail, text, social media)

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.530(c) (administrative, technical and physical safeguards for PHI in any form); 164.502(a)(1)(iii) and 164.502(b) (incidental uses and minimum necessary); 164.312(e) (transmission security) where PHI is electronic. Electronic device, workstation and media controls are in documents 20 and 21; this policy covers the ways PHI leaves a screen and travels through the office and out of it.

Approved by Dr. Maria Lindqvist, Owner. Policy owner: Janelle Okafor, Office Manager.

Purpose and scope

Most privacy incidents in a small practice are not hacks. They are a chart left on a counter, a fax sent to the wrong number, a conversation at the front desk that the waiting room heard, a photo posted online. This policy sets the rules for protected health information in every form at Granite City Family Dental: paper, spoken, on screen, by fax, mail, email, text, video and photograph, and when staff work away from the office. It applies to every workforce member — employees, contractors, volunteers, students and owners — at every location listed in the practice profile. The standard throughout is the same: use or disclose only the minimum necessary, and take reasonable care that no one who does not need the information sees or hears it.

1. Paper records

Granite City Family Dental keeps paper charts or paper forms that contain PHI. Paper PHI is stored as follows: Pre-2019 charts in locked cabinets in the records room; current intake forms scanned same day and shredded weekly..

  • Paper PHI is locked when the area is unattended and overnight; keys and codes are limited to the people listed in the key-holder register (document 20).
  • Clean desk: no chart, form, label, schedule or printout with PHI is left on a desk, counter, exam-room surface or printer when the workforce member steps away. Charts in use are face down or closed.
  • Nothing with PHI sits in open in-trays, mail slots or wall pockets visible to patients or visitors. Exam-room door pockets hold only the patient currently in the room.
  • Charts do not leave the building except for a documented reason approved by the Privacy Officer, in a closed bag, never left in a vehicle.
  • Paper awaiting destruction goes straight into a locked shred console, never a wastebasket or recycling bin. Destruction is by Shred-It, locked console, monthly pickup with certificate; certificates of destruction from a vendor are filed in this binder.
  • Records are retained for the period in document 04 and under Minnesota law; nothing is destroyed early.

2. Oral and visual privacy

How oral and visual privacy is protected at reception and in exam rooms at Granite City Family Dental: Monitors face away from the waiting area; sign-in sheet collects name and time only; conversations about care happen in closed rooms; speakerphone is not used for patient calls at the front desk.

In addition, everywhere in the practice:

  • Speakerphone is not used for any call that involves a patient unless the door is closed and no one outside the conversation can hear.
  • Clinical conversations, phone calls about results and billing discussions happen in a closed room or at a lowered voice away from the waiting area, never in hallways, elevators, break rooms or the parking lot.
  • Staff do not discuss patients by name where other patients, visitors or vendors can hear, and never outside work.
  • Sign-in sheets collect name and arrival time only; no reason for visit, no provider name that would reveal a condition, no insurance details. Each sheet is removed from view once full and shredded or scanned.
  • Patients are called from the waiting room by first name or by a number, not by full name and reason for visit.
  • Screens that could be seen by the public carry privacy filters or are angled away; staff lock the screen before leaving it.
  • Screens lock automatically after 10 minutes and are locked by hand whenever the workforce member steps away (document 21).
  • Visitors, delivery drivers and vendors are not left alone where PHI is visible or audible (document 20).

3. Fax

Granite City Family Dental sends and receives PHI by fax through Open Dental eFax (BAA signed). An e-fax provider that stores or transmits PHI is a business associate; its BAA is tracked in the register (document 19).

  • Every outgoing fax carries the practice's cover sheet with the confidentiality statement: "This message contains confidential health information intended only for the named recipient. If you have received it in error, call 320-555-0142 immediately, do not read or copy it, and destroy it."
  • The sender verifies the destination number before the first fax to any recipient and again whenever a recipient's number is new or changed, by calling the recipient or confirming from the recipient's own letterhead or directory entry, never from a number typed on a request without checking.
  • Frequently used numbers are preprogrammed in the fax system or address book and are checked against the recipient once a year; staff use the preprogrammed entry rather than typing the number.
  • Before sending, the sender checks the number on the display against the request, sends only the pages needed (minimum necessary), and keeps the confirmation sheet or electronic log with the chart or request.
  • Incoming faxes arrive at a machine or inbox that is not visible to the public and are collected promptly; received PHI is filed or scanned the same day.
  • Misdirected fax procedure: the sender tells the Privacy Officer at once; the practice calls the number that received the fax, asks the recipient to destroy or return it and confirm, records the recipient's name and confirmation, corrects the number at its source, and enters the event in the incident log (document 16). Janelle Okafor with counsel decides under document 22 whether the event is a reportable breach; a fax recalled and destroyed unread is usually documented as a low-probability event, but the documentation is still made.
  • A fax delivered as email or portal download is handled under the email rules in section 5 once it is in the inbox.

4. Mail and couriers

  • PHI sent by mail is in a sealed, opaque envelope marked "Confidential", addressed to a named person or department, with the address checked against the request or the record before sealing.
  • Window envelopes are used only when the window shows the name and address and nothing else; nothing with a diagnosis, lab name or "Behavioral Health" appears on the outside.
  • Large record releases go by a trackable method, and the tracking number is recorded with the release.
  • Incoming mail is opened only by staff whose role includes it, at a desk away from the public, and is routed the same day. Patient mail marked for a provider is opened by that provider or their delegate.
  • Returned mail is not re-sent to the same address; the address is verified with the patient first. An envelope that comes back opened is treated as a possible incident and reported to the Privacy Officer.
  • Misdirected mail reported by a recipient is handled under the mitigation steps in document 10 and entered in the incident log.

5. Email

Granite City Family Dental does send patient information by email, through Microsoft 365. PHI is protected in transit only by this method: Encrypted email feature (M365 / Google encryption).

  • Email to patients happens only after the patient has asked for it or agreed to it, and the first message reminds them that email is not fully secure and offers the portal instead. Their choice is noted in the record.
  • Only the minimum necessary goes in an email. Full records are released through the portal or on encrypted media under document 09, not as attachments.
  • The sender checks the recipient address against the record or request before sending, turns off or ignores auto-complete suggestions, and never uses "Reply all" on a message that contains PHI.
  • No PHI appears in the subject line: no patient name, date of birth, diagnosis or test name. "Message from Granite City Family Dental" is enough.
  • PHI is not forwarded to personal email accounts, and practice email is not set to forward automatically to any outside address.
  • Email to other providers, payers and vendors that contains PHI uses the method above; a vendor that will receive PHI by email must have a BAA.
  • A misdirected email is recalled where the platform allows, the recipient is asked to delete it and confirm, and the event is entered in the incident log and handed to Janelle Okafor with counsel under document 22.
  • Email mailboxes are protected by MFA (in place) because a mailbox that holds PHI is an ePHI repository.

6. Text messaging

Text messaging rule at Granite City Family Dental: Appointment reminders only, no clinical content.

  • Text messages to patients contain only the practice name, the appointment date and time, the location, and a phone number. They never contain the reason for the visit, a provider's specialty, results, balances or any other health information.
  • Patients may opt out at any time; the opt-out is recorded in demographics and honored on the next message.
  • Reminder texts go out from the practice's reminder system, not from personal phones.
  • If a patient replies with a clinical question, staff do not answer by text; they call the patient or reply "Please call us at 320-555-0142."
  • Staff never text each other about identifiable patients on personal phones. Internal coordination uses the EHR or the practice's secure messaging.

7. Telehealth

Granite City Family Dental does not offer telehealth. No workforce member conducts a patient visit by video or app until the Security Officer has selected a platform, signed a BAA with its vendor, added it to the ePHI inventory and this policy, and trained the providers who will use it.

8. Social media and online reviews

Rule at Granite City Family Dental: No workforce member may post, confirm or respond to anything identifying a patient on social media or review sites, including replying to a patient's own review. All review responses are generic and approved by the Privacy Officer.

  • A patient who posts about their own care has not given the practice permission to discuss it. Confirming that someone is a patient, or any detail of their visit, in a public reply is a disclosure of PHI. Responses, if any, are generic ("We take all feedback seriously; please call us at 320-555-0142") and are approved by the Privacy Officer before posting.
  • No photographs, videos or stories from the practice that show patients, charts, screens, schedules or whiteboards are posted on any account, personal or practice.
  • Workforce members do not "friend", follow or message patients from personal accounts about their care, and do not look patients up on social media for curiosity.
  • Practice accounts are managed only by people the owner has named, with MFA on the accounts.
  • Requests for reviews are sent only under the marketing policy in document 08 and never mention the service provided.
  • Violations are among the most-cited disclosures against small practices by HHS and are sanctioned under document 05 at the level for intentional disclosure.

9. Photographs and recordings

  • Clinical photographs are taken only on a practice-managed device or directly into the EHR, only with the patient's knowledge, and are filed into the record the same day and removed from the device.
  • No photographs or recordings of patients, charts, screens or documents are taken on personal phones.
  • Photographs for teaching, marketing or publication require the patient's written authorization under document 08.
  • Security cameras do not point at screens, charts or sign-in sheets, and footage is available only to the owner and Privacy Officer.

10. Printers, copiers and scanners

  • Printers that produce PHI are placed where the public cannot reach them. Printouts are collected immediately; a release-to-print or badge function is used where the device supports it.
  • Uncollected printouts found at the end of the day are shredded, and the Privacy Officer is told if it happens repeatedly.
  • Multifunction copiers and scanners hold copies of every page on an internal drive. Before any such device is returned to a lessor, sold, donated or discarded, its drive is wiped or destroyed by CRU Technologies using the method in document 20 (NIST 800-88 purge by IT provider with record), and the disposal is recorded in the disposal log.
  • Scan-to-email and scan-to-folder destinations are configured by CRU Technologies to practice systems only, never to personal addresses.
  • Printers and copiers appear in the device inventory (document 20).

11. Working remotely

  • Work with PHI away from the office happens only on practice-managed, encrypted devices, through the practice's VPN or secure remote tool.
  • Personal devices: Not permitted for PHI.
  • Remote workers use a private space; family members and others cannot see the screen or hear calls. Public Wi-Fi is used only through the VPN.
  • No PHI is printed at home, saved to a personal computer, personal cloud account or personal email, or left in a vehicle.
  • Paper taken off site (if ever permitted under section 1) is returned the next working day.
  • Lost or stolen devices and paper are reported immediately under document 16.

12. Incidental disclosures

A disclosure that happens as a by-product of a permitted use — a name overheard when a patient is called, a chart glimpsed by a visitor despite reasonable precautions — is permitted under 45 CFR 164.502(a)(1)(iii) only when the practice has applied the safeguards in this policy and the minimum-necessary standard. Where those safeguards were not in place, the event is not incidental; it is reported and handled under documents 10 and 16.

13. Reporting and enforcement

Any workforce member who sees PHI left unprotected, sent to the wrong place or discussed where it should not be reports it to Janelle Okafor the same day under document 16; reporting in good faith is never punished. Failure to follow this policy is handled under the sanction policy (document 05). This policy is reviewed each October and whenever the practice adds a communication channel, a location or a device type.

Minnesota note: releases of health records to anyone outside the practice, including other providers, generally require the patient's signed consent under Minn. Stat. 144.293 even when HIPAA would allow the disclosure. The fax, mail and email procedures above apply to how a release travels; whether it may be made at all is decided under document 23.

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________