CRU TechnologiesHIPAA Binder

← All sample documents  ·  Print

Sample document for a fictional practice. Yours is written from your own answers. Get my quote

Confidentiality agreement and workforce acknowledgment forms

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.530(b) and (e) (training, sanctions); 164.308(a)(1)(ii)(C), (a)(3), (a)(5); 164.310(b) (workstation use); 164.316(b).

Every workforce member of Granite City Family Dental — employees, providers, owners, contractors, students and volunteers — signs the Confidentiality Agreement and the Policy Acknowledgment before their first login, and signs the Policy Acknowledgment again after each annual training and whenever the policy set version changes. The Workstation Use Acknowledgment is signed by everyone who uses a computer, tablet or phone for practice work. The Remote Access Acknowledgment is signed by anyone granted remote access. Signed forms are kept in the personnel file for six years after the person leaves; the training roster (document 12) records the dates.

Form 1 — Confidentiality Agreement

Granite City Family Dental

I, _______________________________, an employee, provider, independent contractor, student or volunteer of Granite City Family Dental, understand my responsibility under the practice's confidentiality and privacy policies to patients, employees and co-workers. I have been trained about the significance of confidentiality and agree not to breach those policies.

I will not access medical, billing or personal information that I do not need to perform my job responsibilities.

I will not inappropriately divulge medical, billing or personal information that I have obtained in the course of my job responsibilities.

I understand that I may not access my own record, my family members' records, or the records of friends, co-workers or public figures through the computer systems of Granite City Family Dental other than through the same request process available to any patient.

I understand that a breach of confidentiality will subject me to discipline under the sanction policy, which may include immediate termination of employment or contract, and may subject me to civil liability and criminal penalties under federal and Minnesota law.

A breach occurs in the following instances, which are not intended to include all situations:

  • Discussing any information pertaining to patients with anyone who is not directly involved with the care or business of that patient.
  • Discussing or displaying any information pertaining to patients where it can be overheard or seen by anyone not directly involved with that patient.
  • Describing patient behavior that has been observed or learned through my affiliation with the practice.
  • Sharing, or failing to properly protect, computer passwords, MFA devices or other information authorizing or providing access.
  • Transmitting patient information to any individual, entity or agency without proper authorization, including by personal email, text message or social media.
  • Discussing with a patient his or her treatment, condition or visit outside the continuum of care, unless initiated by the patient and the discussion cannot be overheard by others.
  • Posting, confirming or responding to anything identifying a patient on social media or review sites, including a reply to the patient's own review.
  • Seeking out, divulging or further disseminating medical information regarding employees, co-workers, acquaintances or family members, or confidential business information about Granite City Family Dental.
  • Removing patient information from the practice, in paper or electronic form, except as my job and the practice's policies require.

I understand that the systems of Granite City Family Dental, including Open Dental and Microsoft 365, record every record I open and every action I take, that this activity is logged and may be audited at any time without notice, and that an access I cannot justify by my job duties will be treated as a violation even if I disclosed nothing.

I understand that these obligations continue after my employment or affiliation with Granite City Family Dental ends.

Printed name: __________________________________________ Role: __________________________________________

Signature: ___________________________ Date: ______________

Witness (Janelle Okafor or designee): ___________________________ Date: ______________

Form 2 — Workforce Acknowledgment of HIPAA Policies

Granite City Family Dental — Policy set version 1.0, effective November 1, 2026

I acknowledge that I have received training on, have had the opportunity to ask questions about, and have access to the HIPAA privacy and security policies of Granite City Family Dental, including:

  1. Notice of Privacy Practices and uses and disclosures of patient information, including the minimum-necessary rule (documents 06, 07).
  2. Patient rights procedures: access, amendment, restrictions, confidential communications, complaints (documents 09, 10).
  3. Safeguards for patient information in all forms: paper, spoken, fax, mail, text and social media (document 11).
  4. Workforce security and access: unique logins, no shared accounts, access removed on departure (document 14).
  5. Security awareness, passwords, MFA, acceptable use and reporting suspicious activity (document 15).
  6. Incident response: how and when to report (document 16).
  7. Contingency and downtime procedures (document 17).
  8. Physical safeguards, workstation use and device rules (document 20).
  9. Breach notification responsibilities (document 22).
  10. Minnesota Health Records Act consent requirements (document 23).
  11. The sanction policy, including that it applies to owners and providers as well as staff (document 05).

I understand that I am responsible for following these policies, that I must report suspected violations and security incidents to Janelle Okafor or Janelle Okafor at once, that reporting in good faith will not be held against me, and that violations will be handled under the sanction policy.

I understand that the policies may be updated, that I will be told of changes that affect my work, and that I will sign a new acknowledgment after annual training and when the policy set version changes.

Privacy Officer: Janelle Okafor, 320-555-0142 [email protected]

Security Officer: Janelle Okafor, 320-555-0142 [email protected]

Printed name: __________________________________________ Role: __________________________________________

Training completed on: ______________ Course / module: __________________________________________

Signature: ___________________________ Date: ______________

Received by (Janelle Okafor): ___________________________ Date: ______________

Form 3 — Workstation Use Acknowledgment

Granite City Family Dental — 45 CFR 164.310(b)-(c); 164.312(a)

I acknowledge the workstation rules of Granite City Family Dental:

Workstations are for practice business; personal use is limited and never on systems that hold PHI. Screens lock when unattended. No PHI is stored on local drives, desktops or personal cloud accounts. Remote work happens only on practice-managed, encrypted devices over approved remote access.

I agree that:

  • I will use only my own login and will never share my password or approve an MFA prompt I did not start.
  • I will lock my screen whenever I step away, and I understand the system locks itself after 10 minutes.
  • I will not save patient information to the local desktop or downloads folder, to a personal cloud account, to personal email or to removable media.
  • I will not install software, browser extensions or apps, or connect personal devices, without the Security Officer's approval. Personal devices: Not permitted for PHI.
  • I will keep screens turned away from patients and visitors, collect printouts and faxes at once, and keep paper records locked when not in use.
  • I will send patient information by email only by the approved method (Encrypted email feature (M365 / Google encryption)) and by text only as the texting rule allows (Appointment reminders only, no clinical content).
  • I will report a lost, stolen or damaged device, or any suspicious message or behavior, the same day.
  • I understand that activity on practice systems is monitored and that there is no expectation of privacy in practice systems or accounts.
  • I will return every practice device, key, badge and document on my last day.

Devices assigned to me (type, make/model, serial or asset tag): __________________________________________

Printed name: __________________________________________ Role: __________________________________________

Signature: ___________________________ Date: ______________

Security Officer (Janelle Okafor): ___________________________ Date: ______________

Form 4 — Remote Access Acknowledgment

Granite City Family Dental — 45 CFR 164.312(a), (d), (e)

I have been granted remote access to the systems of Granite City Family Dental for the purpose of: __________________________________________

I agree that:

  • I will connect only through the approved remote access method (the practice VPN or secure remote tool), with multi-factor authentication (Authenticator app), and never through any other path.
  • I will work only on a practice-managed, encrypted device. I will not use a public or shared computer.
  • I will work in a private space where the screen cannot be seen and calls cannot be overheard, and I will not work on patient information in public places.
  • I will not print, download, photograph or copy patient information to a home computer, personal cloud account, personal email or removable media.
  • I will use a password-protected home or mobile network, never open public Wi-Fi without the VPN.
  • I will keep the device locked when not in use, never leave it in a vehicle, and store it out of sight.
  • I will report a lost or stolen device, a suspected compromise, or an MFA prompt I did not start, the same day, to Janelle Okafor or CRU Technologies.
  • I understand that remote sessions are logged and may be reviewed, and that remote access is removed when my role changes or my affiliation ends.
  • I understand that family members and others in my household may not use the device or see the screen.

Device used for remote access (type, make/model, serial): __________________________________________ Encrypted: [ ] Yes

Printed name: __________________________________________ Role: __________________________________________

Signature: ___________________________ Date: ______________

Approved by Security Officer (Janelle Okafor): ___________________________ Date: ______________

Access configured by (CRU Technologies): ___________________________ Date: ______________