HIPAA requires written policies and procedures, and you must keep the documentation for six years. The core set is a designated privacy official and security official, a risk analysis and risk management plan, safeguards policies, workforce training records, business associate agreements, an incident and breach procedure, and a contingency plan.
Why does documentation carry so much weight?
Under 45 CFR 164.316 you must implement policies and procedures to comply with the Security Rule, and retain the documentation for six years from the date it was created or last in effect, whichever is later. The Privacy Rule's administrative section, 164.530, has a matching documentation and six year retention rule, and says the documentation must support your burden of proof under the breach rules. If it is not written down, you will struggle to show you did it.
Which documents does the Security Rule require?
The Security Rule is organized into administrative, physical and technical safeguards. Implementation specifications are marked Required or Addressable. Addressable does not mean optional: you assess whether it is reasonable and appropriate, then implement it, or document why and what you did instead.
Administrative (164.308):
- Risk analysis and risk management plan (required)
- Sanction policy (required)
- Information system activity review procedure (required)
- Assigned security responsibility: name the security official
- Workforce security: authorization, clearance and termination procedures (addressable)
- Information access management: access authorization and modification procedures
- Security awareness and training program
- Security incident response and reporting procedure (required)
- Contingency plan: data backup plan, disaster recovery plan, emergency mode operation plan (required), plus testing and criticality analysis (addressable)
- Periodic evaluation of your safeguards
- Business associate contracts
Physical (164.310): facility security plan and access procedures, workstation use and security rules, and device and media controls including disposal and re-use (required).
Technical (164.312): unique user identification and emergency access procedure (required), automatic logoff and encryption (addressable), audit controls, integrity, person or entity authentication, and transmission security.
Which documents does the Privacy Rule add?
Under 164.530 you must designate a privacy official and a contact person for complaints, train workforce members, keep safeguards, run a complaint process and document every complaint and its outcome, apply and document sanctions, mitigate known harmful effects, and avoid retaliation. Covered entities also publish a Notice of Privacy Practices. Whether the Privacy Rule applies to you in full depends on whether you are a covered entity or a business associate, so confirm with counsel.
What about breaches?
Write a breach procedure that follows 164.404 to 164.410. Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more people, HHS is notified at the same time as individuals. For fewer than 500, you keep a log and report within 60 days after the end of the calendar year of discovery. A business associate must notify the covered entity without unreasonable delay and no later than 60 days. A breach is treated as discovered on the first day it is known, or would have been known with reasonable diligence.
How should you organize the files?
Make one index sheet: document name, rule citation, owner, version, approval date, review date, storage link. Keep prior versions. Add a folder for business associate agreements, one for training records, and one for risk analysis and action plans.
What to do
- Name a privacy official and a security official in writing.
- Complete a risk analysis, record the results and write the risk management plan.
- Write the administrative, physical and technical policies from the list above.
- For every addressable item, document your decision.
- Sign business associate agreements with each vendor that handles protected health information.
- Train the workforce and keep dated records.
- Write the breach and incident procedure with the 60 day clocks.
- Build the index sheet and set a six year retention rule.
- Review documents when operations change and at least once a year.
Quick check
How long must HIPAA documentation be kept?
Six years from creation or from the date it was last in effect, whichever is later (45 CFR 164.316 and 164.530).
Is an addressable specification optional?
No. You assess it, then implement it or document why an alternative is reasonable.
How Safeguard helps automate this
The paperwork is manageable; keeping the technical safeguards evidenced is the harder part. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews, saving your team time for other work. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, not just policies. The agent can open tested fix pull requests for vulnerable dependencies and other findings, but it is off by default, every category starts on Manual, and you pick which run automatically. Safeguard helps prepare evidence; it does not make you HIPAA compliant or replace legal advice. Book a call.
Open the framework mapping demo
Sources
- 45 CFR Part 164 Subpart C, Security Standards
- 45 CFR 164.530, Administrative requirements
- 45 CFR Part 164 Subpart D, Breach Notification
Last reviewed: 18 October 2026.
