Standard Policies and Procedures that are common at HIPAA covered entities:

a. Information Access and Security
b. Media Controls
c. Systems and Network Security
d. Notice of Privacy Practices
e. Right to Request Access and Amendment to Designated Record Set
f. Accounting for Disclosures
g. Request Restrictions or Confidential Communications
h. Reporting Incidents Involving the Security or Privacy of Protected Health Information; Breach Notification
i. Reporting Protected Health Information (PHI) Compliance Issues
j. Authorization Requirements for Use and Disclosure of Protected Health Information, Including Verification of Identification
k. Use and Disclosure of Protected Health Information for Research Purposes
l. Disclosure of PHI to Business Associates
m. Uses and Disclosures of PHI for Marketing
n. Uses and Disclosures of PHI for Fundraising
o. Transmission and Receipt of Protected Health Information via Fax
p. Minimum Necessary Uses, Disclosures, and Requests
q. Personal Representatives
r. Use and Disclosure of De-Identified Information and of Limited Data Sets
s. Electronic Protected Health Information (ePHI) Security Compliance: HIPAA Security Anchor Policy
t. Physical Security Policy
u. Electronic Communication of Health Related Information
v. Information System Activity Review
w. IT Security Incident Response Policy