Healthcare CyberSecure
Starter Kit$149
Professional$349
HIPAA Security Rule guide
HIPAA Security Rule policies and procedures template for small practices
Every practice that handles electronic patient records needs written security policies. Here is what the HIPAA Security Rule asks for in plain English, where the proposed update stands, and editable templates to get started.
- Plain English
- Editable Word & Excel
- Free self-assessment
Updated October 18, 2026 · Get the free self-assessment
The requirement
What the HIPAA Security Rule requires, in plain English
The HIPAA Security Rule (45 CFR Part 164, Subpart C) protects electronic protected health information (ePHI). Every covered entity and business associate must have administrative, physical and technical safeguards that fit their size and risk.
The starting point is an accurate and thorough risk analysis of where ePHI lives and what could happen to it, followed by risk management to reduce those risks. On top of that you need a named security official, workforce training, access controls, audit controls, contingency (backup and recovery) plans, incident procedures and business associate agreements.
The rule also requires written policies and procedures, kept for six years from when they were created or last in effect, and reviewed as your practice changes.
HHS proposed a major update in January 2025 that would make items like MFA, encryption and an asset inventory explicit requirements. As of October 2026 it has not been finalized. Policies that already cover these controls put you ahead either way.
Requirement by requirement
Where each requirement is covered in the Healthcare CyberSecure kit
Every document is editable Word or Excel. Items marked Pro are in the Professional Edition only.
| Requirement | What it means for you | Kit documents |
|---|---|---|
| Security management and risk analysis | Assess risks to ePHI and manage them. |
|
| Assigned security responsibility | Name a security official. |
|
| Workforce training | Train staff on phishing, passwords and handling ePHI. |
|
| Access control and authentication | Unique logins, MFA and least-privilege access to the EHR. |
|
| Encryption and data protection | Protect ePHI at rest and in transit. |
|
| Device, endpoint and remote access | Secure laptops, phones and remote sessions. |
|
| Contingency plan | Back up ePHI and be able to restore it. |
|
| Security incident procedures | Identify, respond to and document incidents. |
|
| Business associates and vendors | Oversee vendors that handle ePHI. |
|
| Patching and vulnerabilities | Keep systems updated and scan for weaknesses. |
|
See a sample page
What the Risk Management Policy looks like
Plain-language templates with bracketed fields for your details, policy IDs that stay the same when you upgrade, and a footer reminding you to customize before use.
- Download right after checkout
- Edit in Microsoft Word, Google Docs or any word processor
- One-time price: Starter $149 · Professional $349
What's inside
Every file in each edition
Policy numbers carry over from the Starter Kit to the Professional Edition, so you can start small and upgrade without renumbering.
Starter Kit
$14917 editable files
Policies 15
- HC-CYB-001Information Security Policy
- HC-CYB-004Password & Authentication Policy
- HC-CYB-005Access Control Policy
- HC-CYB-007Acceptable Use Policy
- HC-CYB-008Security Awareness & Training Policy
- HC-CYB-009Email & Phishing Security Policy
- HC-CYB-011Mobile Device & Remote Work Policy
- HC-CYB-012Data Protection & Encryption Policy
- HC-CYB-013Backup & Recovery Policy
- HC-CYB-014Incident Response Policy
- HC-CYB-015Business Continuity & Disaster Recovery Policy
- HC-CYB-016Remote Access Policy
- HC-CYB-017Vendor & Third-Party Security Policy
- HC-CYB-018AI Acceptable Use Policy
- HC-CYB-019Vulnerability & Patch Management Policy
Plans, guides & assessments 1
- WordImplementation Guide
Workbook 1
- ExcelHealthcare CyberSecure Starter Toolkit
Professional Edition
$34926 editable files
Policies 20
- HC-CYB-001Information Security Policy
- HC-CYB-002Cybersecurity Roles & Responsibilities Policy
- HC-CYB-003Risk Management Policy
- HC-CYB-004Password & Authentication Policy
- HC-CYB-005Access Control Policy
- HC-CYB-006Multi-Factor Authentication Policy
- HC-CYB-007Acceptable Use Policy
- HC-CYB-008Security Awareness & Training Policy
- HC-CYB-009Email & Phishing Security Policy
- HC-CYB-010Endpoint Security Policy
- HC-CYB-011Mobile Device & Remote Work Policy
- HC-CYB-012Data Protection & Encryption Policy
- HC-CYB-013Backup & Recovery Policy
- HC-CYB-014Incident Response Policy
- HC-CYB-015Business Continuity & Disaster Recovery Policy
- HC-CYB-016Remote Access Policy
- HC-CYB-017Vendor & Third-Party Security Policy
- HC-CYB-018AI Acceptable Use Policy
- HC-CYB-019Vulnerability & Patch Management Policy
- HC-CYB-020AI Governance Policy
Plans, guides & assessments 5
- Word30-60-90 Day Action Plan
- Word50-Question Healthcare Cybersecurity Self-Assessment
- WordEmployee Cybersecurity Quick Guide
- WordHealthcare CyberSecure Professional Implementation Guide
- WordIncident Response Plan
Workbook 1
- ExcelHealthcare Cybersecurity Operational Toolkit
Questions
Frequently asked questions
Is the new HIPAA Security Rule final?
No. HHS published a proposed rule on January 6, 2025. As of October 2026 it has not been finalized. The current Security Rule still applies.
Does a small practice really need written security policies?
Yes. The Security Rule requires written policies and procedures, kept for six years, scaled to your size and risk.
Is a policy template the same as a HIPAA risk analysis?
No. The kit helps you document and manage risk, but your practice still has to do its own risk analysis. The templates are not a risk analysis or a compliance determination.
How fast do we have to report a breach?
Notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches of 500 or more also go to HHS and the media; smaller breaches are logged and reported to HHS annually.
Is this legal advice?
No. These are editable templates and plain-English education. Have your attorney or compliance advisor review them.
Free download
Free Healthcare cybersecurity self-assessment
Answer 50 yes / no / not sure questions across 10 areas. Score your results and get clear next steps for your industry.
- Small Business, Law Office, Real Estate, Healthcare, Accounting & Tax, Insurance Agency, Financial Advisor, Auto Dealer, Mortgage & Title, and Cyber Insurance Readiness editions
- Starred priority questions and a scoring table
- Printable PDF
Your assessment is ready
Thanks. Your download should start automatically. If it doesn't, use the button below.
Download the PDFQuestions about your results? Email info@cybriva.ai.
Ready to put it in writing?
Get the Healthcare CyberSecure kit
Start with the Starter Kit or get every policy, form and workbook in the Professional Edition. Policy numbers carry over if you upgrade.
See the full Healthcare CyberSecure pageSources
- HHS: HIPAA Security Rule NPRM
- Federal Register: proposed HIPAA Security Rule update (Jan. 6, 2025)
- HHS: HIPAA Breach Notification Rule
- Pact-One: Is the HIPAA Security Rule final in 2026?
This guide is plain-English education, current as of October 18, 2026. It is not legal advice, an audit or a compliance determination, and Cybriva is not affiliated with any regulator or standards body named here. Rules change and vary by state; confirm how they apply to you with your attorney or compliance advisor.