Note: The policy manuals for privacy are specified for either covered entities or business associates and there are two types of BA manuals depending upon the type of BA (see below for descriptions). We have samples of the CE and the BA1 policy manuals. The policy manual for security is not so specified, the manual is appropriate for both covered entities and business associates, regardless of the types. The Privacy and Security Risk analysis have internal macros that are used to determine which questions to pose to either covered entities or business associates thereby eliminating the need for differing versions.
A. SRA Sample
B. PRA Sample
C. Security Policy Manual Sample
If you have further questions please contact Kelly McLendon, RHIA, CHPS at [email protected].