A HIPAA internal communication policy says which tools staff may use to talk about patients, which they may not, who manages access, how long messages are kept, and what to do when something goes wrong. The template below is ready to fill in. Replace the bracketed parts, have each staff member sign it, keep the signed copies, and review it once a year.
What this policy is for
HIPAA applies to covered entities, meaning practices and other providers, and it requires written policies for how protected health information (PHI), any information that identifies a patient and relates to their health or care, is protected. This template covers one slice of that: how staff communicate with each other. It names the approved tool, which must have signed a Business Associate Agreement (BAA), the contract that makes a vendor responsible for protecting PHI, and it bans the rest.
How to use the template
- Copy sections 1 to 12 into a document.
- Replace every bracket. Most practices have six or seven answers to fill in: the tool, the admin, the retention period, the manager who takes incident reports, and the review date.
- Delete any line that does not apply, such as multiple locations.
- Read it aloud at a staff meeting (it takes about ten minutes) and collect signatures.
- File the signed copies with your HIPAA documentation and diary the annual review.
Template sections 1 to 4: purpose, scope, definitions, approved tools
- 1. Purpose. This policy sets the rules for how workforce members of [Practice name] communicate with each other about patients and practice operations, so that protected health information is handled as HIPAA requires.
- 2. Scope. It applies to every owner, employee, contractor, student and volunteer who works at [Practice name], at every location, on practice-owned and personal devices.
- 3. Definitions. PHI means any information that identifies a patient and relates to their health, care or payment. Approved tool means an application listed in section 4. Incident means any event in which PHI may have been seen, sent or stored outside an approved tool, including a lost device.
- 4. Approved tools. Patient information may be shared between workforce members only through: [Approved chat tool, e.g. Yodl], under a BAA signed on [date]; the practice's EHR, [name]; practice email, [provider], under a BAA signed on [date]; and in person or by phone call. [Add or remove lines.]
Template sections 5 to 8: prohibited tools, message rules, devices, access
- 5. Prohibited tools. PHI may not be sent, stored or discussed in SMS or text messages, WhatsApp, iMessage, Facebook Messenger, Instagram, Snapchat, personal email, personal notes apps, or any application not listed in section 4. This applies even when the message is short or the patient is not named in full.
- 6. Message rules. Workforce members share only the minimum information the recipient needs. Chart numbers and room numbers are used instead of names where possible. Clinical information is documented in the medical record, not in chat. Screenshots, photos and forwards of PHI from the approved tool are prohibited.
- 7. Devices. Any device used to open the approved tool must have a passcode, fingerprint or face lock. The approved tool's automatic lock must stay enabled. Lock-screen notifications must not show message content. A lost or stolen device is reported under section 10 within one hour.
- 8. Access and roles. [Admin name or role] administers the approved tool. Access is by invitation to a work email address only. Channel membership follows the channel map kept by [role]. Access is removed on a workforce member's last day, before they leave the building.
Template sections 9 to 12: retention, incidents, training, acknowledgment
- 9. Retention. Messages and files in the approved tool are retained for [12] months, then deleted automatically. The audit log is retained for six years. [Role] places a legal hold the same day the practice learns of a complaint, lawsuit, investigation, records request or suspected breach.
- 10. Incidents. Any workforce member who loses a device, sends PHI through a prohibited tool, or sees PHI where it should not be reports it to [name or role] immediately, at any hour. [Role] removes affected access, documents the timeline, and completes a breach risk assessment with counsel if needed. Reporting is never punished.
- 11. Training. Every workforce member receives this policy and a short training on the approved tool before using it, and again every [12] months. Training dates are recorded.
- 12. Acknowledgment. I have read this policy, I understand it, and I agree to follow it. Name: ______ Signature: ______ Date: ______
Filling in the blanks: a worked example
| Blank | Example answer |
|---|---|
| [Practice name] | Sunrise Family Dental, PLLC |
| [Approved chat tool] | Yodl, BAA signed on March 3 |
| [Admin name or role] | Office manager (Dana) |
| [Retention period] | 12 months |
| [Incident contact] | Dana, or Dr. Patel if Dana is unavailable |
| [Review cycle] | Every January, and at every new hire |
The example practice is made up. Use your own names and keep the policy to two pages; a policy nobody reads protects nobody.
Keeping the policy alive
A policy earns its keep in three moments: the day a new hire starts, the day someone leaves, and the day a phone goes missing. Put the policy on the onboarding checklist, the offboarding checklist and the incident checklist, and it will be read exactly when it matters. Review it once a year, note the review date on the document, and update section 4 if you change tools.
If section 4 still needs a tool, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Twelve short sections, one page or two, signed and dated by everyone: approved tools, prohibited tools, message rules, devices, access, retention, incidents, training and acknowledgment. Fill in the brackets and you have a policy that an auditor can read and staff can follow.
Frequently asked questions
Does HIPAA require a written communication policy?
HIPAA requires written policies and procedures covering how PHI is protected, and it requires you to keep them for six years. A communication policy is the practical way to cover staff messaging.
Can we have one policy for all locations?
Yes, if the tools and roles are the same. Name the admin for each location in section 8 and keep one document.
What if a staff member will not sign?
Access to the approved tool depends on the signed acknowledgment. Someone who will not sign cannot handle patient information in chat; that is a management conversation, not a HIPAA question.
Do contractors and temps need to sign?
Yes. The scope section covers them on purpose. Anyone who is invited to the approved tool signs first.
How often should we update the policy?
Review it yearly and whenever you change the tool, the admin or the retention period. Note each review date on the document.