Scope
Define settings, populations, and virus types covered; state whether policy applies to employees, contractors, patients, and visitors.
A documented policy clarifies responsibilities, reduces legal and operational uncertainty, and supports regulatory compliance (for example, HIPAA for protected health information and state public health reporting rules). It also makes consistent decision-making possible during outbreaks and helps insurers, accrediting bodies, and auditors verify that reasonable infection-control procedures were in place.
Final approval normally rests with leadership (medical director, compliance officer, or administrator) and should be documented with dates and version control.
Define settings, populations, and virus types covered; state whether policy applies to employees, contractors, patients, and visitors.
Describe symptom checks, testing triggers, PPE requirements, and who conducts and documents screening events.
List internal escalation paths, public health reporting obligations, and templates for patient and employee notifications.
Specify isolation durations, cohorting rules, transfer criteria, and environmental cleaning procedures.
State how clinical and contact-tracing records are protected under HIPAA and retained according to policy retention rules.
Set review frequency, version control, staff training cadence, and simulation/exercise requirements.
| Field | Configuration |
|---|---|
| Signer Order | Sequential routing for medical director then compliance officer |
| Authentication | Email link or SMS code; use stronger ID for PHI access |
| Storage | Encrypted cloud storage with access controls |
| Audit Trail | Capture timestamps, IPs, and action logs |
Ensure any chosen service allows HIPAA Business Associate Agreement execution if the policy will reference or transmit protected health information.
Isolate and begin notification within 24 hours of confirmation.
Report cases to local health department per local rules—often within 24–72 hours.
Complete incident review within 7 days for operational remediation.
Review and update policy annually or after major guidance changes.
Provide required documentation within timeframes required by requestor or statute.
Clinical identification and initial triage of the suspected or confirmed case.
Implement isolation, PPE usage, and immediate exposure control measures.
Notify internal stakeholders and submit required reports to public health.
Complete records, investigate gaps, and update policy as needed.
The medical director usually reviews and signs to confirm clinical soundness and the policy's alignment with current infection-control guidance; signature documents clinical accountability and may be required for facility accreditation.
A compliance or privacy officer signs to verify legal and privacy safeguards (HIPAA), attest to retention practices, and confirm that required BAAs are in place for third-party services.
Save signed policies as PDF/A to preserve format and embed audit metadata for long-term archival and legal reproducibility.
Use PDF or DOCX for editable drafts; final signed copies should be preserved as noneditable PDFs with an audit trail.
Attach screening logs, incident reports, and public health submission receipts to the policy record for context during audits.
Restrict modification rights and grant read-only access to audit teams and regulators as needed.
The clinic standardized screening and consent forms across locations
A small provider implemented an online acknowledgement workflow
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial (no card) | Yes | Yes | Yes | Yes |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |