Frequently asked questions
Everything solo practitioners ask us about HIPAA policies and how the engine works.
Do I really need written HIPAA policies as a solo practitioner?
Yes. The HIPAA Security Rule (45 CFR § 164.316) requires every covered entity — including a solo private practice — to implement and maintain written policies and procedures, retain them for six years, and update them as circumstances change. Practice size changes how complex the policies need to be, not whether you need them.
Which policies does the Policy Engine generate?
The ten policy domains OCR most consistently asks for: designated privacy/security officials, risk analysis and management, workforce sanctions, access management, audit controls, contingency planning, breach notification, business associate agreements, workforce training, and device/media security. If you treat substance use disorder, a 42 CFR Part 2 confidentiality overlay is added automatically.
Is this legal advice?
No. We generate customizable policy templates tailored to your practice profile. We are not a law firm, and using the service does not create an attorney-client relationship. We recommend having a healthcare attorney licensed in your state review your policy set before adoption, and the adoption workflow includes that acknowledgment explicitly.
Do you collect any patient information (PHI)?
Never. The intake asks about your practice — specialty, state, EHR vendor, device habits — not about patients. Because no PHI ever touches our systems, no business associate agreement is required to use the service.
What happens when regulations or guidance change?
Template updates ship as new versions. Your dashboard flags affected policies, shows a side-by-side diff of exactly what changed, and lets you re-attest in one click. Your previously adopted versions are preserved in your audit history — exactly what you want to show OCR if asked.
How is this different from a $99 PDF template pack?
Three ways: tailoring (your policies reference your actual EHR, devices, and state, not [VENDOR NAME HERE]); maintenance (templates are versioned and refreshed — a PDF is stale the day you buy it); and evidence (attestation, effective dates, and version history are recorded so you can demonstrate adoption, not just possession).
How long does setup take?
About five minutes for the intake, and your full policy set is generated immediately after. Most customers review and adopt their policies over a week. The 14-day trial covers the whole cycle, no credit card required.
Can I cancel easily?
Yes — self-serve, from the billing portal, no email or phone call needed. Your adopted policies and audit history remain downloadable during your paid term.
Ready to get your policies in order?
Start your free trial →