HIPAA Evidence Binder Kit
Drafted and Mapped, Not Blank Pages
Ten files, which are nine editable Word and Excel files plus the PDF guide, put the policies, plans, forms, and logs behind every tab of the HIPAA Evidence Binder in one place. The HIPAA policies are already written and mapped to the Security Rule, so you adjust them to your office instead of starting from nothing. Built for a small office, not a hospital. Pay once, no subscription.
Delivered by email within minutes as individual Word and Excel files, plus the guide. Full refund within 14 days if a file will not open or the kit is not as described.
Made for a practice with no compliance department
A medical or dental practice of about 1 to 20 staff usually has one person who ends up responsible for security, and that person also has a day job. The kit gives that person a finished starting point for each document, so the time goes into matching the documents to how the office really works.
Practice owners and office managers
You were named the Security Official by default, or you are about to be. You need written policies, signed forms, and a place to keep them.
Practices that took the Quick Check
You answered the free Quick Check, found gaps, and want the documents that close them. The Read Me maps every Quick Check question to a file in the kit.
Practices preparing for questions
An insurer, a partner, a buyer, or the Office for Civil Rights may ask what you have in writing. The kit helps you gather it before anyone asks.
Not the right fit: hospitals and large health systems, and consultants or managed service providers who want to use the kit with several practices, who need a separate license. Anyone looking for legal advice should speak with qualified counsel.
Ten files, numbered in the order to use them
Six Word documents, three Excel workbooks, and one guide in Portable Document Format (PDF). Every file name starts with a number, so they sort in reading order when you save them to one folder.
- Word
01 Read Me First
Start here. A week-by-week 30-day plan, a map from each file to each binder tab, and the license terms.
- Word
02 Security Policies and Procedures
Nineteen written policies, one for each area of the Security Rule, with procedures a five-person office can follow.
- Word
03 Contingency and Disaster Recovery Plan
System criticality table, backup schedule, restoration order, restore test record, paper downtime procedure, contact tree, and ransomware steps.
- Word
04 Incident Response and Breach Assessment
Incident procedure, incident report form, four-factor breach risk assessment, notification checklist, and a sample letter to affected individuals.
- Word
05 Workforce Forms
Security Official designation, acknowledgments, sanction record, access request, offboarding checklist, and training acknowledgment.
- Word
06 Business Associate Toolkit
Vendor inventory, business associate agreement review checklist, due diligence questionnaire, and return-or-destruction certification.
- Excel
07 Risk Analysis Workbook (Template)
Blank workbook for your asset inventory, scored risk register, heat map, risk management plan, and review log.
- Excel
08 Risk Analysis Workbook (Worked Example)
The same workbook completed for a fictional dental practice, so you can see what finished entries look like.
- Excel
09 HIPAA Evidence Tracker (Complete)
Ninety evidence items across the binder tabs with a status and owner for each, plus logs for incidents, vendors, training, and access changes, and a dashboard.
- PDF
10 HIPAA Evidence Binder Guide
The free guide this kit puts into practice, included for reference as you fill in each tab.
The Read Me lays out a 30-day plan week by week: name the owners and set up the binder, adopt the policies and sign up the workforce, complete the risk analysis and the vendor and backup work, then prepare for incidents and close out.
Three steps, from free to professional
Start where it costs nothing, and move up only when you need to.
Free: guide and Quick Check
Take the free Quick Check and read the free HIPAA Evidence Binder guide to see where your evidence is thin.
The kit: $197
Fill in the policies, forms, plans, and logs, and complete your own risk analysis with the workbook and the worked example.
A professional risk analysis
When you want a credentialed person to examine your systems and vendors, book a free consultation.
One price, one practice, no subscription
All ten files, delivered by email within minutes as individual Word and Excel files, plus the PDF guide.
Buy the Kit for $197Purchases are processed by Stripe. See our privacy policy.
- License. One license covers one practice, meaning one legal entity and all of its locations. You may adapt the templates, adopt them as your own policies, and remove the Adams Cloud and Cybersecurity header and footer from documents you adopt. You may not resell or redistribute the kit. Consultants and managed service providers need a separate license, so please contact us.
- Refund. If a file will not open or the kit is not as described on the sales page, email thabiti@adamscloudcyber.com within 14 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 14 days for any reason. Because downloaded files cannot be returned, a change of mind after download does not qualify for a refund. See the kit terms.
- Support. Questions about using the kit files are answered by email. Support does not include legal advice or a review of your policies.
- Seller. Adams Cloud and Cybersecurity LLC, 10006 Three Oaks Way, Santee, CA 92071. Telephone (619) 289-8064.
- Payment. Checkout is handled by Stripe. Your payment receipt comes from Stripe, and your download links come from us by email.
For comparison, consultants are often quoted $1,500 to $6,000 for a small-practice risk analysis. The kit is a do-it-yourself starting point. It does not replace a professional analysis.
What the kit does and does not do
The U.S. Department of Health and Human Services (HHS) does not require certification of HIPAA compliance and does not endorse or recognize private organizations' HIPAA certifications (HHS answer on certification). This kit helps you build and show your evidence. It is not legal advice, it is not a risk analysis, and it is not a compliance determination.
You still do the work. You fill in your practice details, change each procedure to match what your practice really does, collect the proof, and sign. Have qualified counsel review the documents you adopt.
The kit centers on the Security Rule and breach notification. It does not include a full set of Privacy Rule policies. Rule citations were checked against the Electronic Code of Federal Regulations as of October 30, 2026. In January 2025 HHS proposed changes to the Security Rule that have not been finalized, and the kit follows the rule as it is written today.
Before you buy
What do I receive, and how?
An email with a download link for each of the ten files. The links expire after 7 days, and you can reply to that email for fresh links. Files arrive as individual Word and Excel files, plus the PDF guide.
Will this make my practice compliant?
No product can do that on its own, and HHS does not require certification of HIPAA compliance and does not endorse or recognize private organizations' HIPAA certifications. The kit gives you the documents and a system for keeping the evidence. Your practice still has to do the work and keep it current.
Can I use it for more than one office?
Yes, if the offices belong to the same legal entity. One license covers one practice and all of its locations.
Can a consultant or managed service provider use it with clients?
Not under the single-practice license. Please contact us about a separate license.
What support is included?
Email answers to questions about using the kit files. Support does not cover legal advice or a review of your policies.
What if it is not what I expected?
If a file will not open or the kit is not as described on the sales page, email thabiti@adamscloudcyber.com within 14 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 14 days for any reason. Because downloaded files cannot be returned, a change of mind after download does not qualify for a refund. Before you buy, you can see a filled-in illustrative example and the full kit terms.
HIPAA Security Rule evidence, built by a credentialed professional
HIPAA Security Rule evidence for small medical and dental practices, done by a credentialed security professional.
A credentialed person does the work
Thabiti Adams holds CISSP, CCSP, CCP, Security+ credentials and has more than 18 years in information technology and cybersecurity, much of it on the Department of Defense side. He wrote this kit and answers your questions. You do not reach a call center or a sales rep.
Independent recommendations
We do not sell software, managed IT services, or remediation contracts, so our findings are not steered toward a purchase.
Evidence, not certificates
HHS does not require certification of HIPAA compliance and does not endorse or recognize private organizations' HIPAA certifications. Our method produces the records a practice can hand to the Office for Civil Rights, an insurer, or an auditor: the HIPAA Evidence Binder, the evidence tracker, and the risk analysis.
Local and veteran-owned
Based in Santee, California, and able to be in your office. A Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by the Small Business Administration, and a California Disabled Veteran Business Enterprise (DVBE).
Thabiti Adams
Build Your Binder This Month
Ten files, one price, one practice. Full refund within 14 days if a file will not open or the kit is not as described.