The Publishing Flow

Selecting policies in the library does not automatically make them available to your employees. You must explicitly publish each policy to make it visible in the employee-facing portal. This two-step process — select then publish — ensures you have a chance to review and customize before your workforce sees anything.

Published policies appear in your employees' Policies section when they log into the portal. Each policy shows the title, effective date, and — if attestation is required — a button to acknowledge it.

How to Publish a Policy

From the Privacy Officer dashboard, navigate to Policies
Click any policy to open the detail view
Review the policy content. If you need to customize it, download the document, make edits, and re-upload
Set the Effective Date — typically today or the date you want enforcement to begin
Toggle Require Attestation if employees must formally acknowledge this policy
Click Publish Policy

The policy is now live for all users in your organization. If you add new employees later, they will see all published policies in their portal and can complete attestations at any time.

Understanding Attestation

Attestation is the formal process of an employee acknowledging that they have read and understood a policy. HIPAA requires workforce training and awareness of your policies — attestation records are how you prove that training happened.

When attestation is enabled for a policy, employees see an Acknowledge Policy button in their portal. Clicking it presents a confirmation dialog with the policy name, date, and a statement of understanding. Upon confirmation, the system records a timestamped attestation entry tied to that employee's account.

Tip: Require attestation for all core HIPAA policies — your Privacy Policy, Security Policy, Acceptable Use Policy, and Breach Notification Policy at minimum. For reference documents and supplementary materials, attestation is optional.

Tracking Attestation Completion

From the Privacy Officer dashboard, the Policies section shows an attestation completion percentage for each published policy that requires acknowledgment. Click into any policy to see a detailed list of which employees have attested and which have not.

For employees who have not attested, you can:

Send a reminder from within the portal (click Send Reminder next to their name)
Follow up directly — some employees may need help logging into the portal
Document in your compliance notes if an employee is on leave and will attest upon return

Important: 100% attestation completion is the goal but may not always be immediately achievable (new hires, employees on leave, etc.). What matters for compliance is that you have a system in place, you are actively tracking completion, and you are following up on outstanding attestations. Document any exceptions and their reasons.

Policy Versioning

When you update a policy — whether due to regulatory changes, operational changes, or annual review — publish the updated version and set a new effective date. Employees who previously attested will be prompted to re-attest to the new version. The portal retains the history of all versions and attestation records, giving you a complete audit trail.

Publish Policies