Free HIPAA Confidentiality
Agreement & NDA generator

This HIPAA Confidentiality and Non-Disclosure Agreement ("Agreement") is entered into as of [Effective Date] ("Effective Date") by and between [Employer / Practice Name], located at [Employer Address] ("Employer"), and [Recipient Name], a employee of Employer serving as [job title / role] ("Recipient").

WHEREAS, Employer is a covered entity subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (the "HIPAA Rules"); and

WHEREAS, in the course of the Recipient's duties, the Recipient may create, access, use, or disclose Protected Health Information ("PHI") and other confidential information; the Parties agree as follows:

1. Confidential Information

"Confidential Information" means all Protected Health Information as defined at 45 CFR 160.103, and any patient, client, medical, financial, operational, or business information of Employer or its patients, in any form — oral, written, printed, or electronic — that the Recipient accesses or learns in connection with their employee duties.

2. Obligations of the Recipient

The Recipient agrees to:

(a) Access, use, and disclose Confidential Information only as necessary to perform assigned job duties and only as permitted by Employer's policies and the HIPAA Rules;

(b) Apply the "minimum necessary" standard and access only the minimum Confidential Information required to perform a task;

(c) Not disclose Confidential Information to any person or entity not authorized by Employer to receive it, whether during or after the employee relationship;

(d) Protect Confidential Information by following Employer's administrative, physical, and technical safeguards, including keeping login credentials confidential, logging off unattended workstations, and securing devices and documents;

(e) Not remove, copy, photograph, screenshot, email, or otherwise transmit Confidential Information outside Employer's authorized systems except as required for assigned duties;

(f) Not access the records of family members, friends, coworkers, public figures, or oneself except where required to perform assigned job duties;

(g) Immediately report any suspected or actual unauthorized access, use, disclosure, loss, or breach of Confidential Information to Employer's Privacy Officer; and

(h) Comply with all Employer privacy and security policies and the HIPAA Privacy, Security, and Breach Notification Rules.

3. Prohibited Conduct

The Recipient shall not sell, publish, post on social media, or use Confidential Information for personal gain, curiosity, or any purpose unrelated to assigned duties. Such conduct is strictly prohibited and may constitute a violation of federal and state law.

4. Return of Information

Upon termination of the employee relationship, or upon Employer's request at any time, the Recipient shall promptly return to Employer, or securely destroy, all Confidential Information and all Employer property containing PHI in the Recipient's possession, and shall retain no copies in any form.

5. Duration and Survival

The Recipient's obligations under this Agreement take effect on the Effective Date and shall continue indefinitely after the employee relationship ends. These obligations survive the termination of the Recipient's employee relationship with Employer for any reason.

6. Consequences of Violation

The Recipient understands that any violation of this Agreement may result in disciplinary action up to and including termination of the employee relationship, as well as civil and criminal penalties under HIPAA. Penalties may include fines and, for knowing or malicious violations, imprisonment. The Recipient may be held personally liable for unauthorized use or disclosure of Confidential Information.

7. Acknowledgment

The Recipient acknowledges that they have read and understood this Agreement, agree to comply with it, and have received HIPAA privacy and security training from Employer. This Agreement does not create or alter any employment relationship or term of employment.

8. Governing Law

This Agreement shall be governed by the laws of the State of [State], except to the extent preempted by federal law.

9. Signatures

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

RECIPIENT: [Recipient Name]

Signature: _______________________ Title: [Title] Date: _______________

EMPLOYER: [Employer / Practice Name]

By: [Name] Title: [Title] Date: _______________