HR HIPAA Compliance Agreement

HR HIPAA COMPLIANCE AGREEMENT

Parties and Effective Date

This HIPAA Compliance Agreement (the Agreement) is entered into between Employer Name: and Employee Name: , effective as of .

Personal Information

Position Information

Employment History

Education

References

HIPAA Obligations — Definitions and Scope

Definitions: For purposes of this Agreement, Protected Health Information (PHI) means individually identifiable health information created, received, maintained or transmitted by the Employer or on behalf of the Employer. Employee acknowledges that PHI may be maintained in electronic or paper form and that the obligations herein apply equally to all forms of PHI.

Permitted Uses and Minimum Necessary

Employee shall only access, use, or disclose PHI when such access, use or disclosure is:

a) within the scope of Employee's assigned job duties; b) required for treatment, payment, or health care operations when applicable; or c) otherwise expressly authorized in writing by the Employer. Employee shall apply the minimum necessary standard when accessing PHI.

Privacy, Security and Administrative Safeguards

Employee agrees to comply with all Employer privacy and security policies, including but not limited to: use of unique logins, timely logout, secure password creation and storage, encryption of portable devices where required, and the use of Employer-approved secure methods for transmission of PHI. Employee must not share login credentials or otherwise enable unauthorized access to PHI.

Reporting and Incident Response

Employee shall immediately report any suspected breach, impermissible disclosure, loss of PHI, or security incident to Privacy Officer: Phone: Email:

Failure to promptly report incidents or cooperate with Employer investigations may result in disciplinary action up to and including termination, and may include civil or criminal penalties under applicable law.

Third-Party Disclosures and Business Associates

Employee shall not disclose PHI to third parties except as authorized by the Employer or as required by law. Disclosures to Business Associates must follow Employer procedures and any applicable business associate agreements.

Training and Certification

Employee acknowledges receipt of HIPAA training materials as required by Employer and certifies completion of any required training prior to accessing PHI. Select the appropriate attestations:

I have completed Employer HIPAA privacy and security training.

I will apply the minimum necessary standard and only access PHI as required by my job duties.

Access Privileges and Equipment

Employee acknowledges that access privileges may be granted, modified, suspended, or revoked based on job requirements and compliance. Use of personal mobile devices, cloud storage, removable media, fax, and email when handling PHI is subject to Employer policies.

Sanctions and Remedies

Violations of privacy or security policies, unauthorized access, use or disclosure of PHI, or failure to report breaches will result in disciplinary action up to and including termination and may expose the Employee to civil and criminal liability under applicable law. Employer reserves the right to pursue all available legal and equitable remedies.

Return or Destruction of PHI

Upon termination of employment or upon request by Employer, Employee shall return all PHI and any copies, and shall delete or destroy any PHI stored on personal devices as directed by Employer. Certification of return or destruction must be provided when requested.

Legal Disclosures and Employment Policies

At-Will Employment: Employment with the Employer is at-will unless otherwise expressly provided in a separate written agreement signed by an authorized representative of the Employer. Nothing in this Agreement modifies or limits the at-will nature of employment unless signed by an authorized representative.

Equal Opportunity Statement: Employer is an equal opportunity employer. Employment decisions are made without regard to protected classifications, consistent with applicable law.

Authorization and Certifications

Background Check and References: Employee authorizes Employer to contact prior employers, references, licensing boards, and to obtain background checks and verification of credentials as necessary to determine suitability for employment and access to PHI.

I authorize Employer to conduct background checks and contact previous employers and references as described above.

Applicant Certification: I certify that all information provided in this form is true, complete, and correct to the best of my knowledge. I understand that falsification, omission, or misrepresentation may result in disciplinary action, up to and including termination.

Acknowledgment and Signature

By signing below, Employee acknowledges receipt of this HIPAA Compliance Agreement, understands the obligations contained herein, and agrees to comply fully with all applicable privacy and security policies and laws. Employer acknowledges that it will provide appropriate training, reasonable administrative, technical and physical safeguards, and will enforce policies consistently.

Sign Now