The final HIPAA Security rule published on February 20, 2003 requires that healthcare organizations create policies and procedures to apply the security requirements of the law - and then train their employees on the use of these policies and procedures in their day-to-day jobs.

HIPAA rule has very specific requirements with regard to creating, implementing, or changing Policies and Procedures. "Standard: Policies and Procedures -- A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart. The policies and procedures must be reasonably designed, taking into account the size of and the type of activities that relate to protected health information undertaken by the covered entity, to ensure such compliance. This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of this subpart."

We have developed 67 HIPAA security policies which include 56 security policies & procedures required by HIPAA Security regulation and additional 11 policies, checklist and forms as supplemental documents to the required policies. These policies meet the challenges of creating enterprise-wide security policies. The suite addresses all major components of the HIPAA Security Rule and each policy can be adopted or customized based on your organization's needs. These policies have been updated for HITECH act changes due to ARRA regulation.

I. Policies on the Standards for Administrative Safeguards