Policy management software for US compliance

Written policies, workforce training and six-year documentation. Covered entities and business associates must maintain written policies and procedures for protecting health information, train their workforce on them, and keep that documentation for six years.

• Policies must be documented, current and available to the people who apply them
• Workforce training on privacy and security policies must be evidenced
• Policy changes must be documented and retained
• Risk analysis remains the most frequently cited gap in OCR investigations

Watch: HHS has proposed a major update to the HIPAA Security Rule. It is not yet final, and the federal regulatory agenda currently targets July 2027 for final action.

Survey-ready policies and evidence of staff awareness. Hospitals and health systems are surveyed against accreditation standards and CMS Conditions of Participation, where surveyors expect policies to be current, approved, followed and known to the staff who use them.

• Review dates and approval records for clinical and operational policies
• Evidence that staff know where to find the current version
• Consistent policies across every facility in a system

Documented controls, ethics code and whistleblower protection. Public companies must maintain and assess internal control over financial reporting, disclose whether they have a code of ethics for senior financial officers, and protect employees who report fraud.

• Control policies and procedures documented, owned and reviewed
• Code of ethics accessible and acknowledged
• Whistleblower and anti-retaliation policies communicated to all staff

A written information security program. Financial institutions under the FTC's Safeguards Rule must maintain a written information security program, designate a qualified individual to oversee it, and train staff.

• Information security policies documented and version controlled
• Staff training and acknowledgement recorded
• Regular review of the program by its owner

Compliance policies and supervisory procedures. Registered investment advisers must adopt written compliance policies and review them at least annually, and broker-dealers must maintain written supervisory procedures under FINRA rules.

• Annual review cycles recorded, with changes documented
• Procedures distributed to the right registered roles
• Evidence ready for exams and regulatory inquiries

Student records, nondiscrimination and campus safety policies. Schools and colleges receiving federal funding must protect student records and notify students of their rights, adopt and publish Title IX policies and grievance procedures, and - for colleges - publish an Annual Security Report with policy statements.

• One current, approved version of each policy, with superseded versions withdrawn
• Title IX regulations have changed several times - after the 2024 rule was vacated in January 2025, the 2020 regulations apply - so published policies must match the rules in force
• Staff with records, Title IX or safety responsibilities trained and recorded

Are policies accessible, communicated and working? Federal prosecutors use this guidance, alongside the US Sentencing Guidelines' standards for effective compliance programs, to judge whether a program works in practice - including whether policies are accessible to employees and whether the company tracks access and understanding.

• Policies easy for employees to find, in the tools they use
• Evidence of who has accessed and accepted each policy
• Code of conduct, reporting and anti-retaliation policies communicated and trained

Written safety programs across every location. Many OSHA standards require written programs, such as hazard communication and emergency action plans, and states with their own OSHA-approved State Plans can add requirements - so multi-state employers often need location-specific policies.

• Written programs current and available at each site
• Workers informed and trained, with records kept
• State-specific versions targeted to the right locations

A growing patchwork, from California to Rhode Island. Around 20 states now have comprehensive consumer privacy laws in effect, with more taking effect from 2027, each with its own rules - so organizations operating across states need data handling policies that are documented, current and understood.

• Privacy and data handling policies owned and reviewed as laws change
• Relevant staff trained and acknowledged
• Clear record of what changed and when