HN user
You can also find sample security rule compliance policies that different organizations have created. For example, University of California has theirs at http://www.universityofcalifornia.edu/hipaa/docs/security_gu...
I have a degree in Medical Record Administration and one of my past positions was Manager of Medical Records and Privacy Officer for a hospital. The Office of Civil Rights enforces the HIPAA Privacy and Security Rules. You can check out their HIPAA website at http://www.hhs.gov/ocr/privacy/ You can also review the Security Rule which sets forth guidelines for protecting electronic data. This can be found on http://www.hhs.gov/ocr/privacy/hipaa/administrative/security... - click on "Security Rule Standards - Final Rule" under Security Rule History. It's a pain to read because it's written by the government, but it may have the info you need.