Patient Confidentiality Agreement Template for the United States

A Patient Confidentiality Agreement is a legally binding document that establishes privacy protections between healthcare providers and patients regarding medical information. This agreement ensures your practice complies with federal healthcare privacy laws while clearly defining how patient data will be collected, used, and protected throughout the provider-patient relationship.

When do you need this document?

You need a Patient Confidentiality Agreement before establishing any provider-patient relationship or collecting protected health information. This includes when opening a new medical practice, onboarding new patients, hiring healthcare staff who will access patient records, or implementing new electronic health record systems. The agreement is also essential when partnering with other healthcare providers, conducting medical research involving patient data, or when patients specifically request enhanced privacy protections beyond standard HIPAA requirements.

Key legal considerations

The agreement must clearly define Protected Health Information (PHI) and establish specific protocols for its handling, storage, and transmission. Include detailed provisions for permitted uses and disclosures, such as treatment coordination, payment processing, and healthcare operations. Address patient rights including access to their medical records, amendment requests, and disclosure accounting. Establish breach notification procedures and security safeguards for both physical and electronic health information. Consider including provisions for patient consent to specific uses, minimum necessary standards for information sharing, and protocols for third-party disclosures. The agreement should also address record retention periods, patient authorization requirements, and procedures for handling requests to restrict information use or disclosure.

Legal requirements in United States

Under federal law, your Patient Confidentiality Agreement must comply with HIPAA's Privacy Rule and Security Rule, which govern the use and disclosure of protected health information. The HITECH Act expands these requirements and mandates breach notifications for unsecured PHI. If treating substance use disorders, you must also comply with 42 CFR Part 2, which provides additional confidentiality protections. The Americans with Disabilities Act requires protecting medical information of patients with disabilities, while GINA prohibits discrimination based on genetic information. State privacy laws may impose additional or more stringent requirements than federal regulations, so ensure your agreement addresses applicable state-specific provisions. Some states require enhanced consent procedures, impose stricter disclosure limitations, or provide additional patient rights beyond federal minimums. Mental health records often receive special protection under state laws, requiring separate consent procedures and enhanced confidentiality measures.