Please read the agreement below, then sign at the bottom. This is a condition of your access to patient information.
Workforce HIPAA Confidentiality Agreement
This Workforce HIPAA Confidentiality Agreement ("Agreement") is entered into between the Practice you are joining ("Practice") and the Workforce Member named below ("Workforce Member") as of today's date.
The purpose of this Agreement is simple: while performing work for the Practice, you may see, hear, access, create, receive, or otherwise encounter private information about patients. Protecting that information is a condition of your access to the Practice and its systems.
For purposes of this Agreement, a Workforce Member may include an employee, volunteer, trainee, or other person whose work for the Practice is under the Practice's direct control.
1. Protecting Patient Information
Protected Health Information ("PHI") includes individually identifiable information concerning a patient's health, health care, or payment for health care. PHI may be spoken, written, printed, photographed, electronically stored, or communicated in another form.
As a Workforce Member, I agree that I will:
- Keep patient information private and confidential.
- Access PHI only when necessary to perform my assigned responsibilities.
- Access, use, and disclose only the minimum amount of PHI reasonably necessary for the task when the HIPAA minimum-necessary standard applies.
- Never access a patient's information because of curiosity, personal interest, or for any other unauthorized reason.
- Never use or disclose PHI for personal gain or for the benefit of another unauthorized person.
- Discuss PHI only with people who are authorized to receive the information and only when appropriate for my work.
2. Computers, Accounts, Devices, and Workstations
If I am given access to the Practice's computers, applications, electronic health record, email, network, or other systems, I agree that I will:
- Use only accounts and systems I am authorized to use.
- Never share my password, login credentials, authentication codes, or user account with another person.
- Never use another person's account or credentials.
- Follow the Practice's requirements for passwords and multifactor authentication.
- Lock or secure my workstation when leaving it unattended.
- Protect laptops, phones, tablets, removable media, and other devices containing or providing access to PHI.
- Use Practice-approved methods for storing, transmitting, emailing, or otherwise communicating PHI.
- Follow the Practice's policies concerning personal devices, remote work, cloud services, messaging applications, and other technology.
3. Paper Records and Conversations
Protecting PHI is not limited to computers. I will take reasonable precautions to prevent unauthorized people from seeing paper records, computer screens, labels, schedules, or other information containing PHI.
I will also take reasonable precautions when discussing patient information so that conversations involving PHI are not unnecessarily overheard by people who are not authorized to receive that information.
Documents containing PHI will be stored, transported, and disposed of according to Practice policy.
4. Reporting Problems
I will promptly report any known or suspected:
- Loss or theft of a device or document containing PHI;
- PHI sent or disclosed to the wrong person;
- Unauthorized access to patient information;
- Suspicious email, phishing attempt, malware, or compromised account involving Practice systems;
- Lost or compromised password or authentication credential;
- Improper disposal of PHI;
- Other suspected privacy or security incident.
Reports should be made promptly to your organization's Privacy Officer.
I understand that I should report a potential problem even if I am unsure whether it constitutes a HIPAA breach. The Practice will determine whether further investigation or action is required.
5. Consequences of Unauthorized Access, Use, or Disclosure
I understand that accessing, using, or disclosing PHI without authorization may violate Practice policy and applicable law. Violations may result in disciplinary action consistent with the Practice's sanctions policy, up to and including termination of employment or other workforce relationship when appropriate. Nothing in this Agreement prevents the Practice from taking any other action required or permitted by law.
6. Confidentiality Continues After My Work Ends
My responsibility to protect confidential patient information does not end when my employment, training, volunteer service, or other relationship with the Practice ends. I may not retain, access, use, disclose, copy, photograph, download, or otherwise take PHI after my authorization to access it has ended, except when specifically authorized or required by law.
Any Practice property, records, devices, credentials, keys, or other materials must be returned or handled according to Practice policy when my relationship with the Practice ends.
7. Acknowledgment
By signing below, I acknowledge that:
- I have read and understand this Agreement.
- I understand that protecting PHI is part of my responsibility as a member of the Practice's workforce.
- I agree to follow the Practice's HIPAA privacy, security, and related policies and procedures.
- I understand that this Agreement does not replace required HIPAA training.
- I understand that questions about whether I may access, use, or disclose PHI should be directed to my supervisor, Privacy Officer, or Security Officer before I take action when practicable.