6 Steps to Start Writing and Managing HIPAA Policies and Procedures

  • Sarah Badahman
  • Compliance Strategies

Policies and procedures are the backbone of your HIPAA compliance program. They direct your entire team on how to carry out the standards of the HIPAA privacy, security, and breach notification rules.

Policy management is the process of creating, distributing, and updating policies and procedures within an organization. No matter how you maintain your policies and procedures – on paper or in electronic form – you must have a policy management process.

Here are six steps to get you started:

  1. Write your HIPAA policies and procedures
  2. Make policies and procedures available to staff
  3. Train staff on policies and procedures
  4. Develop a review and approval process
  5. Maintain version control
  6. Use templates/software to streamline policy management

1. Write Your HIPAA Policies and Procedures

Your policies should establish the following:

  • Purpose. All policies and procedures are written with a specific purpose in mind, such as meeting a goal, implementing a standard, or providing instructions. You should place the purpose of the policy at the beginning of the document, so the reader understands why the policy was written.
  • Scope. Who does the policy apply to? Is it written for a specific department or the entire organization? Does the policy apply in all situations or only in specific situations? Identify the scope of the policy early on.
  • Procedures. Procedures are the substance of the policy. Here you spell out the “how to” of the policy – the actions employees or the organization should take to meet the requirements of the policy. Procedures should be clear and concise, using short sentences and common words that everyone can understand.

In the Policies module of our HIPAA compliance software, you can build out procedure sections directly within the policy. Add, remove, update, and approve procedures – all from a single place.

  • Definitions. Some policies include very technical terms. Most of the time, the recipients of the policy will understand the terminology. However, keep in mind that people in the policy review process may not have the same knowledge as the person who carries out the procedure. Ambiguity or misinterpretation can work against your policies. Therefore, you should include a section that defines technical terms, so everyone is clear on what the policy means.

Policies should provide direction, not confusion. For this reason, we added a Definitions module to our software. This module contains many HIPAA-related terms, and you can add your own. Throughout the software, you can quickly see definitions by hovering over the underlined words.

2. Make Policies and Procedures Available to Staff

When you create a policy, you must communicate it to the staff members responsible for carrying it out. Too often, managers develop procedures to help their staff carry out a task but fail to communicate the procedures to staff!

How can employees carry out HIPAA procedures if the policies and procedures are unavailable to them? Make sure you communicate your policies and procedures to your staff, as well as make the documents available so your team can see and use them.

3. Train Staff on Policies and Procedures

You can’t assume that your staff will understand their responsibilities or know how to complete tasks required by your policies. Besides making policies available to staff and communicating policies to them, you must go a step further and train them on your policies. Training staff on policies means equipping them to carry out the procedures as they are written.

4. Develop a Review and Approval Process

Policies aren’t written in a vacuum. They must be reviewed and approved by others above the policy writer’s level. For example, a department head may write a policy, which the director then reviews and sends to the board of directors to give the final approval.

Regardless of your organization’s structure, you should record the individuals involved in the RAF process (review, approve, finalize) within the policy. This gives legitimacy to the finalized policy.

5. Maintain Version Control

Maintaining version control over your policies is an important principle of policy management. Version control means you can revisit previous iterations of the policy. HIPAA requires you to maintain your policies’ version history for six years. However, some States require you to retain your policies longer.

6. Use Templates/Software to Streamline Policy Management

We know the frustration of juggling binders packed with documents. Policy management can quickly become a tangled mess of papers and deadlines. That’s why we recommend using some type of resource – such as templates or software – to ease the burden of writing and managing your policies and procedures.

Policy Management: In Summary

Policies and procedures are the backbone of your HIPAA compliance program. They direct your entire team on how to carry out HIPAA standards. To get started on your policy management process, we recommend the following six steps:

To learn more about how you can use HIPAAtrek as a policy management tool at your organization, check out our platform page or contact us at support@hipaatrek.com.

Need More Help? Grab Our Guide to Policy Management!

Policy management can be overwhelming, so we’ve created this workflow to help you get started.