Compliance & HIPAA

Ending a client or vendor relationship without clear terms invites a dispute. This service agreement termination and release formally concludes a service relationship while protecting both parties—addressing outstanding payments and refunds, discontinuation of services, confidentiality, non-dispa...

This notice is generally required—and a frequent gap in healthcare compliance. This HIPAA notice of privacy practices for healthcare providers communicates how patient information is collected, used and protected, outlining patient rights to access, correct and restrict records, and how PHI is us...

If you serve California consumers, CCPA/CPRA compliance isn't optional—and non-compliance carries real fines. This California supplemental privacy notice helps you meet CCPA and CPRA requirements by disclosing how personal information is collected, used, shared and protected, including categories...

You're required to document that patients received your privacy notice—this is how. This HIPAA notice of privacy practices acknowledgment form records that patients have received and reviewed your Notice of Privacy Practices, with signature and date fields, a representative-signature section, and...

Without documented policies, you can't demonstrate HIPAA compliance when it matters most—an audit or investigation. This HIPAA privacy policies and procedures manual provides a complete framework for managing and protecting PHI: PHI use and disclosure, administrative, technical and physical safeg...

A dispute with a patient can escalate into a lawsuit—or a viral review—without the right paperwork. This refund, waiver and non-disparagement agreement provides a settlement-style framework for resolving disputes: a refund in exchange for a full release of claims, a non-disparagement clause (incl...

Group health plans have their own HIPAA notice obligations that generic forms don't cover. This HIPAA notice of privacy practices for group health plans explains how protected health information may be used and disclosed for treatment, payment and healthcare operations, and outlines the patient r...

Releasing patient records without proper authorization is a textbook HIPAA violation. This patient authorization for release of health information is a HIPAA-compliant form that lets patients specify exactly what information may be released, to whom, by what method and for what purpose—covering m...

Ending a patient relationship the wrong way invites an abandonment claim. This notice of termination of physician–patient relationship lets you formally discontinue care while staying legally and ethically compliant—with a structured termination notice, optional discharge reasons, a 30-day transi...

Every vendor that touches your patients' PHI is a potential breach—and a potential liability for you. This covered entity–friendly HIPAA business associate agreement establishes a strict, compliant framework governing how vendors may use, disclose, store and protect protected health information, ...

HIPAA obligations don't stop at your first vendor—they flow all the way down the chain. This HIPAA subcontractor business associate agreement binds the contractors and third parties your business associates engage, helping to help ensure every downstream party that handles PHI is contractually he...

Not every BAA should be drafted to crush the vendor—sometimes you're the business associate, or you want terms a vendor will actually sign. This business associate–friendly HIPAA agreement meets HIPAA and HITECH requirements while keeping the structure practical and balanced for vendor relationsh...

An OSHA inspection or workplace incident is not the moment to discover your safety documentation is thin. This medical spa OSHA and workplace safety manual is a comprehensive compliance framework covering workplace safety rules, hazard communication, personal protective equipment and a full blood...

When something goes wrong, the quality of your documentation determines whether it's a managed event or a liability. This incident report policy and procedures document gives medical practices and med spas a standardized process to identify, document and respond to adverse events, near misses and...

How long should you keep a patient chart? What about employment files or financial records? Get it wrong and you face regulatory penalties—or destroyed evidence you needed. This document and medical records retention policy gives your medical spa a defensible framework for retaining, storing and ...

Sharing patient data—even for research or operations—creates HIPAA exposure the moment safeguards slip. This HIPAA data use agreement (DUA) establishes the legal framework for disclosing a limited data set, defining permitted uses, required safeguards and each party's obligations to prevent unaut...