Monday - Friday 9AM – 6PM EST
A workforce acknowledgement that sits inside a real compliance programme. Build your HIPAA employee confidentiality agreement in minutes with Document Genius's step-by-step questionnaire.
Choose the state or form type you need to start.
Answer a few simple questions to customize your form.
Download or print your custom document in PDF or Word.
A HIPAA employee confidentiality agreement is a document signed by workforce members of a healthcare organisation, acknowledging their obligations regarding patient information.
A HIPAA employee confidentiality agreement sits inside a much larger compliance framework. Healthcare privacy obligations in the United States are set by federal regulation, and an employee agreement is one small part of how an organisation demonstrates that its workforce understands them.
The document typically records that the individual has been trained, understands what patient information may and may not be accessed or disclosed, and knows the consequences of breaching that.
It is not a substitute for a compliance programme. Policies, training, access controls, audit, and breach response are what actually protect patient information, and a signature alone does none of that.
Healthcare privacy compliance is detailed, technical, and consequential, and it cannot responsibly be summarised in a template page.
We do not state what the regulations require, which organisations they apply to, what counts as protected information, what must appear in any document, what training is mandated, or what happens after a breach. Those questions have specific answers set by regulation and enforced by a federal agency, and getting them wrong carries real penalties for the organisation and real harm for patients.
If your organisation handles patient information, work with a healthcare compliance professional or an attorney experienced in healthcare privacy. That applies whether you are a large provider, a small practice, or a vendor handling data on a provider’s behalf.
This template is a general confidentiality acknowledgement. It may form part of what your compliance advisers put in place, but it is not a compliance programme, not legal advice, and not a substitute for advice specific to your organisation.
Tip: If you are searching for this document because someone told you the practice needs one, that is a good moment to ask who is responsible for privacy compliance overall. The document is rarely the only thing missing.
Organisations typically ask a wide range of people to sign a HIPAA employee confidentiality agreement.
The breadth is deliberate. People without clinical roles frequently encounter patient information incidentally, and they need to understand their obligations just as much as those who access records directly.
Subject to what your compliance advisers require, a HIPAA employee confidentiality agreement typically covers the following.
The organisation, the individual, their role, and the date.
That the person has received privacy and security training.
That records are accessed only where the role requires it.
That the individual will not access records of family, friends, colleagues, or themselves outside proper channels.
That patient information is not discussed or shared outside authorised purposes.
Screen locking, secure disposal, and not removing records.
That login details are not shared and access is not used by others.
That suspected breaches are reported promptly through the stated route.
That breach may lead to disciplinary and other consequences, signed and dated.
Deliberate theft of patient data is rare. Looking at a record someone had no business looking at is not.
Staff look up their own records, family members, neighbours, colleagues, and occasionally people in the news. It usually feels harmless to the person doing it, and it is one of the most frequently disciplined privacy failures in healthcare.
Say this explicitly in training and in the document. Naming the behaviour — including looking at your own chart or a relative’s — removes the ambiguity that lets people rationalise it.
Explain that access is logged. Most systems record every record opened and by whom, and staff who understand that audit is routine behave differently.
Tip: Give people a proper route to their own records. Someone who knows how to request their chart through the correct process has no reason to look it up at a workstation.
This document should be issued as part of a wider process rather than on its own. Document Genius walks you through each section with simple questions.
Work with a healthcare compliance professional or attorney on what your organisation actually requires.
The acknowledgement should follow training, not replace it.
Clinical, administrative, technical, and support roles.
Curiosity access, shared credentials, and unattended screens.
Name where a suspected breach is reported and to whom.
Retain signed copies and refresh training periodically. Start yours now and confirm the form with your compliance advisers.
It is worth being direct about the limits.
It does not make an organisation compliant. Compliance rests on policies, training, technical safeguards, risk analysis, and breach procedures, and a signed acknowledgement evidences one part of that.
It does not protect against a breach. Access controls, encryption, and audit do that work.
It does not settle vendor relationships. Organisations handling patient information on another’s behalf are typically subject to their own arrangements, which are a separate matter for your advisers.
It does not prevent lawful reporting. Nothing in a confidentiality acknowledgement stops a workforce member reporting suspected violations to the appropriate authority, and agreements should not be drafted or presented as if it does.
Nothing on this page is legal or compliance advice. No regulatory requirement, covered entity definition, training mandate, breach threshold, or penalty is stated anywhere on it. Take advice from a healthcare compliance professional or an attorney experienced in healthcare privacy.
One place to build, sign, and manage documents.
