Stated policy typically includes a statement of least privilege data access to complete the job, definition of PHI and incident monitoring and reporting procedures.
http://www.prlog.org/10144978-medical-billing-software-com-announces-release-of-medisoft-medical-billing-software-version-14.html