The HIPAA Policies and Procedures a Small Practice Actually Needs

Which HIPAA policies does a small practice actually need?

About twenty, and the list is set by the regulation rather than by a template vendor. The Security Rule at 45 CFR 164.316 requires written policies and procedures for every standard it contains, the Privacy Rule at 164.530 adds a handful more, and the Breach Notification Rule adds one. Everything else is optional.

The tables below map each policy to the standard it satisfies. A policy that maps to no row is one to question. A row with no policy is a finding in your next risk analysis.

Security Rule: administrative safeguards (164.308)

Policy	Standard	What it has to say
Risk analysis and risk management	164.308(a)(1)	How often you assess risk, who owns the findings, how fixes are tracked
Sanction policy	164.308(a)(1)(ii)(C)	What happens to staff who break the rules, applied consistently
Information system activity review	164.308(a)(1)(ii)(D)	Who reviews audit logs and access reports, and how often
Security officer	164.308(a)(2)	The named person responsible, by role and by name
Workforce security	164.308(a)(3)	Authorization, supervision, clearance and termination procedures
Information access management	164.308(a)(4)	How access is granted, changed and reviewed
Security awareness and training	164.308(a)(5)	Training on hire and when policies change, reminders, malware, logins, passwords
Security incident procedures	164.308(a)(6)	How incidents are reported, handled and documented
Contingency plan	164.308(a)(7)	Backup, disaster recovery, emergency operations, testing, criticality analysis
Evaluation	164.308(a)(8)	Periodic technical and non-technical review of whether the policies still work
Business associate contracts	164.308(b)	Which vendors need a BAA and how you track them

Security Rule: physical and technical safeguards (164.310 and 164.312)

Policy	Standard	What it has to say
Facility access controls	164.310(a)	Who can enter where, visitor handling, keys and badges
Workstation use and security	164.310(b) and (c)	Screen locks, positioning, home and remote use
Device and media controls	164.310(d)	Disposal, reuse, inventory of devices, backup before moving equipment
Access control	164.312(a)	Unique user IDs, emergency access, automatic logoff, encryption
Audit controls	164.312(b)	What is logged and where logs are kept
Integrity	164.312(c)	How you detect improper alteration of ePHI
Authentication	164.312(d)	Password rules, MFA, how identity is verified
Transmission security	164.312(e)	Encryption in transit, secure email and messaging

The current rule labels some of these implementation specifications "addressable", which means you must implement them or document why an alternative is reasonable. Addressable has never meant optional, and OCR reads the documentation.

Privacy Rule and Breach Notification Rule

• Notice of privacy practices (164.520): the document patients receive and acknowledge.
• Uses and disclosures, including minimum necessary (164.502 and 164.514): who may see what, and for which purpose.
• Patient rights (164.524 through 164.528): access, amendment, accounting of disclosures, restrictions.
• Complaints (164.530(d)): how a patient complains and who responds.
• Privacy officer and training (164.530(a) and (b)).
• Breach notification (164.400 through 164.414): the risk assessment for a suspected breach, the 60-day deadline, the annual log for incidents under 500 individuals.

What the documentation standard itself requires

Section 164.316 adds three rules that apply to every policy above. Keep them in writing (electronic is fine). Keep every version for six years from creation or last effective date. Review them periodically and update them when operations or the environment change. The last one is the clause that turns a one-time template purchase into a compliance failure two years later, which is why the HIPAA annual review exists.

One note on the Security Rule update. The January 2025 proposal would remove the addressable label and make most of the specifications above mandatory, with written procedures required for each; it is still a proposal; the Unified Agenda lists final action for July 2027; the current rule applies now. Policies written honestly against the current rule will need editing when the final rule lands, not rewriting.

Writing them in the right order

Do not start with the policies. Start with the risk analysis, because a policy written before you know where ePHI lives describes a practice that does not exist. Risk analysis vs a full compliance program explains the sequence. The business associate policy depends on a vendor inventory, and the BAA checklist lists what each agreement needs to contain.

Then write short. A two-page policy staff have read beats a forty-page one nobody opens. Each policy needs an owner, a date and a version number; the procedure can live in a separate document that changes more often.

Where AccuSights fits

We write the policies after the risk analysis, against the controls you actually run, with a named engineer rather than a ticket queue, and implementation and remediation included so the policy and the configuration match. We do not certify HIPAA compliance; no one can. Start with the HIPAA framework page or book a free Risk Diagnosis and we will tell you which rows in the tables above you are missing.