Annual review meeting minutes and attestation

Granite City Family Dental — Binder edition 2026 — Policy set version 1.0

Authority: 45 CFR 164.308(a)(8) (evaluation); 164.316(b)(2)(iii) (periodic review of documentation); 164.530(i) (review of privacy policies). Procedure: document 18.

These minutes are the record of the 2026 evaluation required by HIPAA. Prior years remain in this binder unchanged. If the meeting has not yet been held, the blanks below are completed at or after the meeting in October.

Minutes of the 2026 annual HIPAA review — Granite City Family Dental

1. Date, location and attendees

Meeting date: October 20, 2026 Location: Main office, 412 2nd Street South, St. Cloud, MN 56301 Attendees: Dr. Maria Lindqvist; Janelle Okafor; Blake Thoennes (CRU Technologies)

Compliance committee of record: Dr. Maria Lindqvist (Owner); Janelle Okafor (Privacy and Security Officer); CRU Technologies (IT provider). Chaired by Janelle Okafor.

2. Officer designations

Privacy Officer: Janelle Okafor, Office Manager. Security Officer: Janelle Okafor, Office Manager. Backup designee: Dr. Maria Lindqvist. Complaint contact: Janelle Okafor.

Designations re-confirmed at this meeting: Yes. Privacy Officer signature: ___________________________ Security Officer signature: ___________________________ Owner signature: ___________________________

3. Risk analysis and risk management

Current risk analysis dated October 20, 2026, performed by Janelle Okafor with CRU Technologies. Scope: This risk analysis covers all electronic protected health information created, received, maintained or transmitted by the practice at every location listed in the practice profile, in every system in the ePHI inventory, on every device in the device inventory, and in paper form where paper is used.

Register status at this meeting: 5 risks recorded — 3 open, 1 in progress, 1 closed, 0 accepted.

Summary (risks closed since last year, risks still open, residual risks accepted):

First documented analysis. Five risks recorded: one closed (backup restore test), one in progress (server encryption, due December), three open (EHR MFA, phishing simulations, clearinghouse BAA). No residual risks accepted.

Residual risks accepted and signed by Dr. Maria Lindqvist, Owner: ___________________________ Date: ______________

4. Evaluation results — controls sampled

M365 MFA enforced for all 9 users (admin center screenshot); workstation BitLocker confirmed on 7 of 7; server not encrypted; backup restore test passed 2026-10-18; Open Dental audit log reviewed for September; access list reviewed 2026-10-01.

Gaps found are entered in the risk register with owners and due dates (document 18, section 5).

5. Incidents and breaches

No incidents or breaches this year. No under-500 report due.

Incident log rows this year: 1. Under-500 HHS report (due March 1) is the responsibility of Janelle Okafor.

6. Patient-rights metrics

One access request (completed in 2 days). No amendment, restriction or accounting requests. No complaints. No contact from OCR.

Request log rows this year: 1. Internal target 10 days; legal limit 30 days. Complaint acknowledgment target 5 days.

7. Training

Workforce training completion: 78% of 9 workforce members. Roster rows: 3. New hires trained within 30 days; refresher annually; reminders quarterly; phishing tests No.

Action: the people not yet trained complete training within 30 days; Janelle Okafor reports completion to the Privacy Officer.

8. Workforce changes

One hire (Tom Reyes, hygienist, September); training due by November 8. No departures.

Departures logged this year: 0. User access list certified at this meeting: [ ] Yes [ ] No — Security Officer initials: ______

9. Business associates

DentalXChange agreement requested October 20; all other agreements current.

Register rows: 5; without a signed agreement: 1. Reviewed by Janelle Okafor.

10. Device inventory

Inventory reconciled against devices present: Yes. Inventory rows: 4; disposals logged: 0.

11. Sanctions

Sanctions imposed this year: 0. Imposed by Privacy Officer with the owner's approval; applied to owners and providers as well as staff: Yes. The committee reviewed the sanction log for consistency with the sanction ladder (document 05).

12. Policy changes and regulatory watch

Policy changes approved this cycle:

Initial adoption of the complete policy set version 1.0, effective November 1, 2026.

Regulatory watch:

HIPAA Security Rule update: proposed January 2025, not yet final (target July 2027); when final, expect mandatory MFA, encryption, asset inventory, 72-hour restore and annual audits. 42 CFR Part 2 notice changes effective February 16, 2026. Minnesota Health Records Act unchanged.

13. Actions for next year

Next review meeting: October 19, 2027.

14. Attestation

I, Dr. Maria Lindqvist, Owner and Dentist of Granite City Family Dental, attest that the policies, procedures, risk analysis, registers, minutes and other documentation required by 45 CFR 164.316 and 164.530(j) are retained for six years from the date of their creation or the date they were last in effect, whichever is later, in the location named in the retention attestation below, and that these minutes are a true record of the 2026 review.

Signature: ___________________________ Date: October 20, 2026 Minutes recorded by Janelle Okafor: ___________________________ Date: ______________

Prior years

This is the first edition of the binder; there are no prior-year minutes. Each renewal adds that year's minutes here, read-only.

Six-year retention attestation

The owner confirms each year that this document, the minutes of every prior year, and the policies and registers they refer to are kept for at least six years from creation or last effective date (45 CFR 164.316(b)(2)(i); 164.530(j)(2)).

Where they are kept: This binder (CRU HIPAA Binder Builder, exported yearly) and a printed copy in the administrator's locked office.

How they are destroyed after the retention period: Cross-cut shredding for paper; secure deletion of electronic copies after the retention period.

Owner: Dr. Maria Lindqvist Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________