HIPAA Security Narrative Template

Similar to the System Description required for SOC 2 reports (also referred to as Section III), as described in the System Description Basics article, the HIPAA Security Narrative is management's overview of an organization's product/service and the security practices that are in place to secure it.

If you are solely pursuing a HIPAA certification, use the template below:

If you are pursuing a HIPAA certification in addition to SOC 2, check out the System Description Additions article for a corresponding template.

Auditors will review the HIPAA Security Narrative for a baseline understanding of an organization's security practices, so make sure to perform a detailed review of the template and tailor it to accurately reflect your organization's practices.

Tips:

• The black text is templated language that should remain in the document.

• The red text is guidance and should be deleted after it is utilized.

• The purple signifies sample responses; they offer example language that is sufficient, but all text should be closely reviewed and revised to accurately reflect your organization's practices.

• In addition to typed text, graphics/charts may be added to the HIPAA Security Narrative (i.e. Data Flow Diagram, Network Diagram, Organizational Chart).

How to use this template:

• Click on the link above to access the template

  • If you are a Google Workplace organization, make a copy by going to File > Make a copy

  • If you are not a Google Workplace organization, download a copy by going to File > Download and selecting your preferred file type (available as DOCX, PDF, and more)

• Review and then remove instructional text

• Save in a centralized place

• Attach to evidence either through Integrations, Automated Collection, or direct upload.