How to HIPAA: Policies & Governance
Free HIPAA guide · 14 controls · 7 templates
Map how your team works to HIPAA provisions: policies, documentation and retention, training, and sanctions. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- Documentation & organizational requirements
- The contracts and written policies that make everything else enforceable. In an audit, an undocumented control is treated as a control you don't have, and an unmonitored vendor becomes your liability.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 14 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.316(a) · 164.316(b)(1) · 164.316(b)(2)(i) · 164.316(b)(2)(ii) · 164.316(b)(2)(iii) · 164.530(i) · 164.530(j) · 164.308(a)(1)(ii)(C) · 164.308(a)(3)(ii)(B) · 164.308(a)(5)(i) · 164.308(a)(5)(ii)(A) · 164.530(b) · 164.530(e) · 164.530(g)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Security awareness & training 164.308(a)(5)
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AdversarialPhishing / credential theft
Exploits: No or weak MFA; reused passwords · 164.312(d) Authentication; 164.308(a)(5) Training
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 14 controls in this area.
Join Us