Checklist template

Patient privacy and records security for clinics

A ready-to-use checklist with 112 items in 6 sections, covering Front desk privacy, Screens, Paper records, Disposal, Access, Incidents. Use it as-is in Bindy, or adapt it to your own standards in minutes.

  • 6 Sections
  • 112 Items
  • 94 Yes / No checks
  • 6 Scored ratings
  • 124 Points

Use this template How audits work

1. Front desk privacy 19 items

  1. A sign or floor marker asks waiting patients to stand back from the check-in counter Yes / No 1 pt
  2. Staff calling a patient from the waiting room did not say the provider's specialty or the reason for the visit aloud Yes / No 1 pt
  3. Staff ask for the reason for the visit in a lowered voice or have the patient write it down Yes / No 1 pt
  4. The sign-in sheet, where one is used, does not ask for the reason for the visit Yes / No 1 pt
  5. Earlier names on the sign-in sheet are removed or blacked out before the next patient signs Yes / No 1 pt
  6. Two identifiers are confirmed before any patient information is discussed at the counter Yes / No 1 pt
  7. Calls about test results or account balances are taken at a station out of earshot of the waiting room Yes / No 1 pt
  8. A room or screened area is offered to a patient who wants to discuss a sensitive matter away from the counter Yes / No 1 pt
  9. The voicemail script used for patients states only the clinic name and a callback number Yes / No 1 pt
  10. The printed schedule for the day is kept face down or in a folder at the front desk Yes / No 1 pt
  11. Clipboards with completed intake papers are taken from patients at once and not left on the counter Yes / No 1 pt
  12. Insurance cards and photo ID are handed back to the patient right after scanning Yes / No 1 pt
  13. Nothing was left on the glass or in the tray of the front desk scanner or copier at the time of the visit Yes / No 1 pt
  14. Chart pockets and routing slips outside exam room doors face the wall so the name is hidden Yes / No 1 pt
  15. Self check-in kiosks or tablets are angled or shielded so the next patient cannot read them Yes / No 1 pt
  16. Background music or a sound-masking unit is running near the check-in counter Yes / No 1 pt
  17. No label, wristband or encounter sheet of an earlier patient was left on the front desk label printer Yes / No 1 pt
  18. No staff conversation about a patient could be heard from the waiting room during 10 minutes of observation Yes / No 1 pt
  19. Privacy of conversations at the check-in counter during the visit Rating
    • Could not be overheard 5 pts
    • Partly overheard from the nearest seats 3 pts
    • Names and reasons for visit clearly heard 1 pt

2. Screens 19 items

  1. Front desk monitors are turned away from the public side of the counter Yes / No 1 pt
  2. Privacy filters are fitted on monitors that can be seen from the waiting room or a patient corridor Yes / No 1 pt
  3. Every unattended workstation seen during the visit was locked or logged off Yes / No 1 pt
  4. Staff lock the exam room computer before leaving a patient alone in the room Yes / No 1 pt
  5. The previous patient's chart is closed on screen before the next patient enters the exam room Yes / No 1 pt
  6. No password or login note is taped to a monitor, keyboard or desk Yes / No 1 pt
  7. Each staff member signs in to the electronic record with a personal user ID, never a shared one Yes / No 1 pt
  8. Workstations on wheels parked in corridors have the screen locked Yes / No 1 pt
  9. The patient tracking board shows initials or a room number rather than full names Yes / No 1 pt
  10. Clinic tablets are locked in a cabinet or charging cart when the clinic closes Yes / No 1 pt
  11. Laptops that leave the clinic appear on the IT list of encrypted devices Yes / No 1 pt
  12. Two employees asked confirmed that personal phones are not used to photograph patients or records Yes / No 1 pt
  13. Patient information is texted only through the secure messaging app approved by the company Yes / No 1 pt
  14. The e-fax inbox is closed on shared workstations when the user steps away Yes / No 1 pt
  15. Telehealth visits are held in a room with the door closed Yes / No 1 pt
  16. Staff use a headset for telehealth calls so the patient's voice is not heard in the corridor Yes / No 1 pt
  17. Unattended workstations found unlocked during the visit Number
  18. Idle time before the screen locks on a sampled exam room workstation (minutes) Number
  19. Patient information visible on screens from public areas Rating
    • None visible 5 pts
    • Visible on one screen 3 pts
    • Visible on several screens 1 pt

3. Paper records 18 items

  1. Paper charts are filed in lockable cabinets or in a records room with a locking door Yes / No 1 pt
  2. The records room or chart cabinets were locked when no staff member was present Yes / No 1 pt
  3. Charts pulled for the day are returned to the file before closing Yes / No 1 pt
  4. An out-guide or sign-out log shows who holds each chart removed from the file Yes / No 1 pt
  5. No chart, lab report or referral letter was left unattended in an exam room during the visit Yes / No 1 pt
  6. Printers and fax machines that receive patient documents stand in a staff-only area Yes / No 1 pt
  7. Printer and fax output trays held no uncollected patient documents at the time of the visit Yes / No 1 pt
  8. Outgoing faxes carry a cover sheet with a confidentiality statement Yes / No 1 pt
  9. Fax numbers stored in speed dial were verified in the last 12 months Yes / No 1 pt
  10. Unused specimen and chart labels printed with a patient name go into the shred console Yes / No 1 pt
  11. Outgoing mail with patient documents waits for pickup behind the counter, out of public reach Yes / No 1 pt
  12. Each release of records is logged with the date, the recipient and the signed authorization Yes / No 1 pt
  13. Photo ID is checked before copies of records are handed to a patient at the counter Yes / No 1 pt
  14. Boxes of records sent to offsite storage are listed on an inventory kept at the clinic Yes / No 1 pt
  15. Whiteboards in view of patients carry no full name next to a diagnosis or procedure Yes / No 1 pt
  16. Paper encounter forms and superbills are collected from exam rooms at the end of each session Yes / No 1 pt
  17. Charts found outside the file with no sign-out record Number
  18. Security of paper records in the areas walked Rating
    • All locked or attended 5 pts
    • A few documents left unattended in staff areas 3 pts
    • Records open to passers-by 1 pt

4. Disposal 19 items

  1. A locked shred console stands within reach of the front desk Yes / No 1 pt
  2. A locked shred console stands within reach of each nursing station Yes / No 1 pt
  3. The slot of each shred console does not allow paper to be pulled back out Yes / No 1 pt
  4. Shred console keys are held only by the staff named by the clinic manager Yes / No 1 pt
  5. No patient document was found in the regular trash or recycling bins checked during the visit Yes / No 1 pt
  6. No paper is stacked on top of or beside a full shred console Yes / No 1 pt
  7. The shredding vendor collected on the contract schedule over the last 3 months Yes / No 1 pt
  8. The certificate of destruction from the last shredding pickup is on file Yes / No 1 pt
  9. Date of the last shredding pickup Date
  10. Consoles are emptied by the shredding vendor, not by the janitorial contractor Yes / No 1 pt
  11. Prescription vials, IV bags and specimen cups have the patient label removed or blacked out before disposal Yes / No 1 pt
  12. Retired computers, copiers and fax machines have a record from IT that the drive was wiped or destroyed Yes / No 1 pt
  13. No retired computer or copier is waiting for disposal in an unlocked area Yes / No 1 pt
  14. USB drives, discs and imaging films awaiting destruction are kept in a locked container Yes / No 1 pt
  15. Records past their retention date are destroyed only with the written approval required by company policy Yes / No 1 pt
  16. The destruction log lists the record type, the date range and the date destroyed Yes / No 1 pt
  17. Regular trash and recycling bins checked during the visit Number
  18. Patient documents found in regular trash or recycling Number
  19. Disposal of patient information Rating
    • Everything goes to locked shredding 5 pts
    • Isolated items found in regular trash 3 pts
    • Patient documents routinely in regular trash 1 pt

5. Access 18 items

  1. The door between the waiting room and the clinical area closes and latches on its own Yes / No 1 pt
  2. Patients and visitors are escorted beyond the waiting room Yes / No 1 pt
  3. Vendors and service technicians sign the visitor log before entering staff areas Yes / No 1 pt
  4. Visitors in staff areas wear a visitor badge Yes / No 1 pt
  5. Staff wear their photo ID badge where it can be seen Yes / No 1 pt
  6. The server or network closet is locked Yes / No 1 pt
  7. The list of holders of records room keys matches the staff who need access Yes / No 1 pt
  8. Keys and badges of the last 3 employees who left were collected or deactivated by their last day Yes / No 1 pt
  9. Electronic record accounts of the last 3 employees who left were disabled by their last day Yes / No 1 pt
  10. Access rights of 3 sampled users in the electronic record match their job role Yes / No 1 pt
  11. The clinic manager reviews the list of active electronic record users at the frequency set by company policy Yes / No 1 pt
  12. Date of the last review of electronic record users Date
  13. Each employee who arms or disarms the alarm has an individual code Yes / No 1 pt
  14. The staff entrance was closed and not propped open at the time of the visit Yes / No 1 pt
  15. Cleaning contractors working after hours have a signed confidentiality agreement on file Yes / No 1 pt
  16. Outside vendors who handle patient information (shredding, IT support, transcription) have a signed confidentiality agreement on file Yes / No 1 pt
  17. Students, temporary staff and volunteers sign a confidentiality agreement before their first shift Yes / No 1 pt
  18. Control of access to clinical and records areas Rating
    • Controlled at every point checked 5 pts
    • One uncontrolled point 3 pts
    • Public can walk into records areas 1 pt

6. Incidents 19 items

  1. The written procedure for reporting a privacy incident is available to staff at the clinic Yes / No 1 pt
  2. Two employees asked could name the person to tell when a record is lost or sent to the wrong recipient Yes / No 1 pt
  3. A privacy incident log is kept at the clinic or in the company system Yes / No 1 pt
  4. Privacy incidents recorded in the last 12 months Number
  5. Date of the most recent privacy incident Date
  6. Each incident in the log states what happened, the date it was discovered and the action taken Yes / No 1 pt
  7. Incidents sampled were reported to the privacy officer within the time set by company policy Yes / No 1 pt
  8. Notices to affected patients are on file where local regulation required them Yes / No 1 pt
  9. Misdirected faxes and emails appear in the incident log Yes / No 1 pt
  10. Lost or stolen devices were reported to IT on the day they were discovered Yes / No 1 pt
  11. Chart access audit reports are reviewed for unauthorized viewing at the frequency set by company policy Yes / No 1 pt
  12. All staff completed privacy training in the last 12 months Yes / No 1 pt
  13. New hires completed privacy training before they received an electronic record login Yes / No 1 pt
  14. A signed confidentiality agreement is on file for each of 5 employees sampled Yes / No 1 pt
  15. Corrective actions from the previous privacy review have been completed Yes / No 1 pt
  16. Name of the privacy officer or privacy contact for the clinic Short text
  17. Name of the clinic manager Short text
  18. Overall protection of patient privacy and records Rating
    • No patient information seen, heard or left unsecured during the visit 5 pts
    • Isolated lapses, corrected on the spot 3 pts
    • Patient information exposed in several areas 1 pt
  19. Corrective actions required Comments

About this template

This checklist is part of the Bindy template library. Yes / No checks score 1 point when met; ratings score the points shown for each option. The overall score is the percentage of points earned, with N/A answers excluded. In Bindy you can add photos, assign corrective actions, require sign-off and compare results across sites.

Categories

Related templates

← All templates

Brand standards

At every site, every time

Start Free Contact us