Your Policy Library

HIPAA requires covered entities and business associates to have written policies and procedures governing how they handle protected health information. The OGC portal provides a complete library of HIPAA-compliant policy templates covering every required area of the Privacy Rule and Security Rule.

These are not generic boilerplate documents. Each policy is written to be specific, actionable, and compliant with current regulatory requirements. They are designed to be reviewed, lightly customized for your organization, and published to your workforce.

Accessing the Policy Library

From the Privacy Officer dashboard, click Policies in the left navigation. The library view shows all available policies organized by category. You can also browse from the employee-facing policies section to see what your staff will see once policies are published.

CE vs. BA Policies: What's the Difference?

The policy library includes policies for both covered entities (CEs) and business associates (BAs). Understanding the distinction is important for selecting the right policies for your organization.

Covered Entity (CE) Policies

Covered entities are healthcare providers, health plans, and healthcare clearinghouses that transmit PHI electronically. If your organization directly provides or bills for healthcare services, you are a covered entity. CE policies cover patient rights, Notice of Privacy Practices, treatment/payment/operations disclosures, and direct patient care workflows.

Business Associate (BA) Policies

Business associates are organizations that handle PHI on behalf of a covered entity — billing companies, EHR vendors, IT providers, medical transcription services, etc. BA policies focus on the handling and protection of PHI received from CEs, subcontractor management, and BAA obligations.

Tip: Some organizations are both a covered entity AND a business associate — for example, a billing company that also provides direct patient care services. In that case, you should adopt policies from both categories. When in doubt, include more policies rather than fewer.

Browsing Policy Categories

Policies are organized into the following main categories:

Privacy Rule — Uses and disclosures of PHI, patient rights, notice of privacy practices, administrative requirements
Security Rule — Administrative — Security management, workforce controls, access management, contingency planning
Security Rule — Physical — Facility access, workstation controls, device and media management
Security Rule — Technical — Access controls, audit controls, encryption, transmission security
Breach Notification — Breach assessment, notification procedures, reporting timelines

What to Look for When Reviewing

As you browse each policy, assess whether it is relevant to your operations. Ask:

Does this workflow or situation occur at our organization?
Are there placeholder fields (organization name, contact info, dates) that need to be filled in?
Does the policy reflect how we actually operate, or does it need modification?
Is this policy required by HIPAA, or is it a best practice we choose to adopt?

Important: Do not publish policies that do not reflect your actual practices. A policy that says "all workstations are encrypted" when they are not is worse than having no policy — it creates a documented misrepresentation of your controls.

Next Steps

Once you have reviewed and selected the policies relevant to your organization, proceed to Step 6 to publish them and configure attestation requirements for your workforce.

Review Policies