HIPAA Written Policies Every Practice Needs

Why Written Policies Are Required

Two separate HIPAA provisions create the written policy requirement. Under the Security Rule, 45 CFR 164.316(a) requires covered entities and business associates to implement reasonable and appropriate policies and procedures to comply with the standards and implementation specifications of Subpart C. Under the Privacy Rule, 45 CFR 164.530(i) requires covered entities to develop and implement written privacy policies and procedures consistent with the Privacy Rule's requirements.

Both provisions also require a retention period. Under 45 CFR 164.530(j), covered entities must retain all policies and procedures for six years from the date of creation or the date when the policy was last in effect, whichever is later. The Security Rule carries the same six-year retention requirement under 45 CFR 164.316(b)(2)(i).

How Many Policies Does Your Practice Need?

Most small practices need 20 to 35 written policies across administrative, physical, and technical safeguards plus Privacy Rule and breach notification requirements. The exact number depends on how your practice operates: what systems you use, how many locations you have, whether you handle specialty records, and which vendor relationships involve PHI.

HIPAA does not prescribe an exact number of policies. What it requires is that every applicable standard and implementation specification be addressed in writing. Some organizations consolidate related requirements into fewer documents. Others maintain separate policies for each safeguard. Either approach can satisfy the regulation as long as every requirement is covered.

If you need help determining which policies apply to your practice, a HIPAA gap analysis identifies exactly where your documentation falls short. If you already know what you need and want ready-to-customize documents, see our HIPAA policy templates and documentation services.

Administrative Safeguard Policies

Administrative safeguards are the management actions, policies, and procedures that form the backbone of your compliance program. These typically represent the largest group of required written policies.

Physical Safeguard Policies

Physical safeguards protect the physical infrastructure — buildings, equipment, and media — that stores or accesses ePHI.

Technical Safeguard Policies

Technical safeguards are the technology and related policies that protect ePHI and control access to it.

Privacy Rule Policies

Privacy Rule policies govern how your practice uses and discloses PHI in all forms — not just electronic. These are required of covered entities under 45 CFR 164.530(i).

Breach Notification Policies

Breach notification policies document your procedures for identifying, investigating, and reporting breaches of unsecured PHI. These are required by the Breach Notification Rule.

Specialty-Specific Policy Considerations

Some practice types require additional policies beyond the standard set. If your organization falls into one of these categories, your policy library should account for these specialty requirements.

• Dental practices — digital imaging retention, shared operatory access controls, and policies for portable x-ray equipment that moves between operatories or locations.
• Behavioral health providers — psychotherapy notes receive heightened protection under 45 CFR 164.508(a)(2). Substance abuse treatment records may also fall under 42 CFR Part 2, requiring additional consent and disclosure policies.
• Business associates — must maintain their own independent set of Security Rule policies, not just rely on the covered entity's policies. Also need subcontractor BAA management procedures.
• Pharmacies — additional policies for controlled substance record handling, prescription transfer procedures, and telephonic/electronic prescription verification.

What Makes a Policy Actually Compliant?

Having a policy on paper is not enough. OCR has cited organizations for maintaining policies that did not reflect actual operations. Under 45 CFR 164.316(b)(2)(i), policies must be tailored to the size, complexity, and capabilities of the organization. A compliant policy includes:

• A specific CFR citation — identifies which regulatory requirement the policy addresses.
• A named responsible party — the person accountable for implementation and enforcement.
• Defined scope — which workforce members, systems, or locations the policy covers.
• Procedures that match actual workflows — not generic template language, but steps your staff actually follow.
• A review date and version history — demonstrating periodic review as required by 45 CFR 164.316(b)(2)(iii).
• Staff acknowledgment records — evidence that workforce members received and understood the policy.

If you are starting from scratch, begin with the HIPAA starting point guide to understand the sequence. If you need customized policies written for your practice, our policy template and documentation services include implementation guidance and staff acknowledgment tracking.

Frequently Asked Questions

Learn More About HIPAA Policies and Compliance