A HIPAA employee confidentiality agreement is a healthcare worker's signed promise to keep patient health information private. Healthcare workers handle protected health information, including patient medical records. In order to protect these patients, HIPAA requires healthcare workers to sign a confidentiality agreement. The HIPAA act of 1996 was created to ensure that the private medical records of individuals would not be shared with other parties without those individuals knowing.
Last Updated: October 2026. This guide is reviewed and updated regularly to reflect current law. If you notice an error or outdated information, please contact us.
Build Your Document
Answer a few simple questions to make your document in minutes
Save and Print
Save progress and finish on any device, download and print anytime
Sign and Use
Your valid, lawyer-approved document is ready
The confidentiality agreement should cover the key 18 pieces of PHI. It needs to state that the signee of the contract will not violate the terms enclosed that protect the rights of patients.
The 18 pieces of information named as confidential by HIPAA are as follows:
All of this information is deemed confidential and therefore protected under HIPAA.
HIPAA still applies upon leaving a health care position. Former healthcare professionals will still be prosecuted if they reveal any of the confidential information that they had access to while working as a health care employee. This must be noted in the non disclosure agreement template.
Also included in a HIPAA agreement is the confirmation that the employee will return any PHI that is requested by the company immediately. This means that whatever health information the employee has access to is at the discretion of their employer.
In addition to all of the information above, there is a need for general provisions to be accounted for in the agreement. This includes an affirmation of following the laws of the state and a clause that specifies the punishment of the employee upon breach (in addition to legal punishment).
The signed agreement is only the start. Everyday habits keep PHI safe at your desk, on your screen, and in conversation. Ask your employer about its HIPAA compliance practices, and use the habits below as a starting point.
The confidentiality agreement is very similar to a simple non-disclosure agreement. It simply requires basic information from the covered entity and their employee. Many agreements are sent via PDF for employees to fill out upon hiring.
Anna Baker starts work as a medical assistant at Main Street Family Clinic. On her first day, office manager Dana Lee gives her the HIPAA confidentiality agreement. Anna reads the whole agreement, including the list of 18 kinds of PHI, before she signs anything.
She writes today's date at the top and prints her full name on the employee line. Main Street Family Clinic goes on the employer line. Anna signs with the same name she printed, and Dana signs for the clinic. Each of them keeps a copy for their records.
If your employer sends the agreement as a PDF, fill in each field on screen and save a copy before you send it back.
Common mistakes
HIPAA’s confidentiality agreement covers health plans, health care clearinghouses, and health care providers that share information. The goal of HIPAA is to cover anyone who may see confidential information in their jobs. HIPAA employees have to sign a document stating their dedication to keeping the privacy of their patients.
The goal of HIPAA’s privacy rule is to allow the access of health information by those who require it, while safeguarding this confidential information from others. Organizations or other healthcare providers that the Privacy Rule applies to are defined as covered entities.
In addition to the basic Privacy Rule, the Security Rule protects electronic health data that is shared with healthcare professionals. Covered entities are responsible for protecting their electronic data and preventing breaches under the Security Rule.
HIPAA specifically protects 18 key pieces of identifying information. These include the full name of the patients. If the name is being used in a medical capacity, it is a violation of HIPAA to share the name of a patient. Other information that is protected includes geographic location, dates that are connected to an individual (such as graduation, birth, and death), phone numbers, fax numbers, and other identifying information.
Read the whole agreement before you sign it. These questions help you spot anything unclear.
Yes, keep one for your own records. A copy lets you check later what you agreed to, including which of the 18 kinds of PHI the agreement lists. Store it somewhere safe, and note where you put it.
Under HIPAA, a healthcare worker that shares a patient’s private medical information without their knowledge or permission is subject to severe penalty. The confidentiality agreement (also called a nda agreement) states that a worker will not share any protected health information (also known as PHI). This includes information they have received electronically.
Workers are bound by confidentiality agreements to only request and view information that is necessary for the care of the patient. They are often required to dispose of or destroy PHI once it is no longer necessary for their care of the patient.
Upon signing a confidentiality agreement, an employee is legally bound to that document, much like an NDA. Any breach of the terms stated within the agreement will lead to a heavy penalty. Violation of the Health Insurance Portability and Accountability Act is a violation of the law.
The HHS has a special law enforcement branch called the Office for Civil Rights that specifically targets violations of HIPAA. As a result, the confidential health information of individuals is strongly protected, leading to more private information in the healthcare sector.
Outside of the government, healthcare providers will also punish employees on their own if they violate the agreement. Any breach of the Health Insurance Portability and Accountability Act damages the reputation of the organization or entity that it took place under, so employers will often sue employees for damages if they violate.
General information, not legal or tax advice.
