Theory: The Policy Hierarchy
By the end of Week 3, MediCare Plus Hospital’s risk register lists many risks, each with a Likelihood × Impact score, for example “Unpatched legacy imaging server: High likelihood, High impact, Risk Level Critical.” But a risk score only tells the organization “this matters.” It does not tell everyone what they must do about it, every day, without the security team in the room. That is the job of policy. This lesson explains why organizations need written policy and how the four levels of the policy hierarchy (Policy, Standard, Procedure, Guideline) divide the work from “why” down to “how, exactly”.
Why Risk Decisions Need Policy
Imagine MediCare Plus’s IT Manager personally deciding, case by case, whether each of the hospital’s hundreds of staff may access patient records. It “works”, until she is on leave, a new hire starts, or a decision is challenged in court. Written policy solves three problems:
| Benefit | What it means |
|---|
| Consistency | The same rule applies whether the decision-maker is present or not. |
| Accountability | A written policy is evidence of due diligence to auditors, regulators and courts. |
| Scale | New staff, new systems and new vendors inherit the rule automatically. |
Without policy, risk decisions don’t scale: they live in one person’s head and disappear when that person is unavailable.
The Four Levels
Diagram loads as you scroll.
The top three levels are mandatory; the guideline is optional. Moving down the hierarchy, documents become more detailed, more technical, and more likely to change.
The policy hierarchy
- Policy: a high-level statement of management intent. States what the organization requires and why, not how. Approved at the top; changes rarely. Mandatory.
- Standard: a specific, mandatory requirement that supports a policy. Sets a measurable bar, the same for everyone everywhere in scope. Mandatory.
- Procedure: step-by-step instructions for how to meet a standard. Detailed and operational; the level most likely to change as tools and processes evolve. Mandatory.
- Guideline: recommended practice, not mandatory. Offers judgment and flexibility for situations a standard does not fully specify. Optional.
Level 1: Policy
- Generic example: “All patient data must be protected against unauthorized disclosure, in compliance with applicable law.”
- MediCare Plus example: “MediCare Plus Hospital shall protect the confidentiality, integrity, and availability of all patient health information.” Approved by the Hospital Board; reviewed annually.
A policy contains no product names, numbers of minutes or configuration settings. Those belong lower down, so the policy can stay stable for years.
Level 2: Standard
- Generic example: “All workstations must be encrypted using AES-256 and locked after 5 minutes of inactivity.”
- MediCare Plus example: “All systems storing patient records must enforce multi-factor authentication and auto-lock after 5 minutes idle.” Set by IT Management; applies hospital-wide.
The test for a standard: can you measure compliance? “5 minutes”, “multi-factor”, “AES-256” can all be checked.
Level 3: Procedure
- Generic example: “Step 1: Open Settings › Security. Step 2: Enable BitLocker. Step 3: Save the recovery key to …”
- MediCare Plus example: steps for granting a new hire access to the imaging server:
- HR submits the request.
- IT verifies the role.
- Access is granted with least privilege.
- The grant is logged in the access system.
Procedures change whenever the software, the menu layout or the workflow changes, which is exactly why they are kept separate from the policy.
Level 4: Guideline
- Generic example: “When working remotely, consider using a privacy screen in public spaces.”
- MediCare Plus example: “When discussing patient cases in shared hospital spaces, staff are encouraged to use private consultation rooms where available.”
Signal words such as “consider”, “encouraged” and “where available” mark a guideline. Not following a guideline is not a policy violation.
Comparing the Levels
| Policy | Standard | Procedure | Guideline |
|---|
| Answers | Why / what is required | What exactly (measurable) | How, step by step | Suggested good practice |
| Mandatory? | Yes | Yes | Yes | No |
| Detail | Broad | Specific, measurable | Very detailed, operational | Flexible advice |
| How often it changes | Rarely | Occasionally | Most often | As needed |
| MediCare Plus owner / approver | Hospital Board approves | IT Management sets | IT Manager owns | Advisory |
Common mistakes:
- Putting technical detail in a policy. “Use AES-256” is a standard, not a policy statement.
- Calling a guideline mandatory. If it says “consider” or “encouraged”, it is a guideline and is optional.
- Confusing standard and procedure. A standard says what level must be reached (“patch within 30 days”); a procedure says how to do it (“IT runs monthly patch scans…”).
One Risk, Four Levels of Response
A single risk-register entry can produce a document at every level. Risk: “Unpatched legacy imaging server: Critical.”
| Level | Statement |
|---|
| Policy | “All clinical systems must be kept secure and available.” |
| Standard | “All systems must be patched within 30 days of a critical vendor release.” |
| Procedure | “IT runs monthly patch scans; flagged systems are scheduled for patching within 5 business days.” |
| Guideline | “Where a legacy system cannot be patched, consider network isolation as an interim measure.” |
An exam trick for classifying a statement: look for numbers or measurable limits (Standard), numbered steps or named tools (Procedure), “consider / encouraged / recommended” (Guideline), and broad intent with “shall protect…” (Policy).
Worked Examples
Exercise 1
Classify each MediCare Plus statement as a Policy, Standard, Procedure or Guideline.
a) “Passwords for clinical systems must be at least 12 characters long.”
b) “MediCare Plus shall ensure that only authorized personnel can access patient information.”
c) “To reset a locked account: 1) Call the IT help desk. 2) Verify your staff ID. 3) Set a new password at the prompt.”
d) “Staff are encouraged to lock their screen even when stepping away for only a moment.”
e) “All backups of patient data must be tested for restoration every 90 days.”
Show solution ↓Hide solution ↑
Solution
Apply the signal-word test to each.
a) A specific, measurable requirement (12 characters): Standard.
b) Broad management intent, no detail on how: Policy.
c) Numbered step-by-step instructions: Procedure.
d) “Encouraged”, so optional advice: Guideline.
e) Specific and measurable (every 90 days), mandatory: Standard.
a Standard, b Policy, c Procedure, d Guideline, e Standard.
Exercise 2
Explain why procedures are the level most likely to change, while policies change rarely. Why is it useful to keep them in separate documents?
Show solution ↓Hide solution ↑
Solution
- A procedure describes exact steps using specific tools and workflows (“Open Settings › Security, enable BitLocker”). Whenever software is upgraded, a vendor is replaced or a workflow is redesigned, the steps change.
- A policy states intent (“protect the confidentiality of patient information”). That intent stays true no matter which tools are used, so it changes only when the organization’s goals, risks or legal obligations change.
Why separate them: a policy is approved at the top (the Hospital Board). If tool-level steps were written inside it, every software update would need Board re-approval. Keeping them separate lets the IT Manager update procedures quickly while the approved policy stays stable.
Procedures change with tools and processes; policies change only with goals, risk or law, so separating them keeps top-level approval stable and operational detail easy to update.
Exercise 3
(Mini-case) A nurse ignores the advice “Staff are encouraged to use private consultation rooms where available” and discusses a case at the nurses’ station. Separately, another nurse leaves a workstation unlocked for 20 minutes despite the rule “All systems storing patient records must auto-lock after 5 minutes idle.” Which, if either, is a policy violation? Explain using the hierarchy.
Show solution ↓Hide solution ↑
Solution
- The first statement uses “encouraged” and “where available”: it is a guideline, which is recommended practice and not mandatory. Not following it is poor practice but not a violation.
- The second is a standard: a specific, measurable, mandatory requirement (5 minutes). A workstation that stayed unlocked for 20 minutes means the requirement was not met, which is a violation (and also shows the auto-lock control is not working as required).
Only the second case is a violation, because standards are mandatory while guidelines are optional.
Exercise 4
MediCare Plus’s risk register lists: “Malware introduced to clinical workstations through personal USB drives.” Write one statement at each of the four levels of the hierarchy to address this risk.
Show solution ↓Hide solution ↑
Solution
Start broad and get more specific at each level, checking each against its definition.
| Level | Model statement | Why it fits |
|---|
| Policy | “MediCare Plus shall protect clinical systems from malicious software.” | Broad intent, no detail |
| Standard | “Personal USB drives and removable media must not be connected to any clinical workstation; USB storage ports on clinical workstations must be disabled.” | Specific, checkable, mandatory |
| Procedure | “1) IT applies the USB-blocking setting to each new clinical workstation. 2) IT verifies the setting before the workstation goes live. 3) The check is recorded in the asset log.” | Step-by-step how |
| Guideline | “When you need to move files between devices, consider using the hospital’s secure shared drive instead of removable media.” | Optional advice (“consider”) |
One answer per level as above; the key is broad intent → measurable rule → steps → optional advice.
Exercise 5
(Conceptual) Give the three reasons from the course why risk decisions “don’t scale” without written policy, using a MediCare Plus example for each.
Show solution ↓Hide solution ↑
Solution
- Consistency: when the IT Manager is on leave, staff at MediCare Plus still get the same answer on who may access patient records, because the rule is written down rather than in her head.
- Accountability: if a patient complains to a regulator after a breach, the written access policy is evidence of due diligence that the hospital set clear rules.
- Scale: when the new outpatient wing opens with new staff and systems, they inherit the existing access rules automatically instead of needing case-by-case decisions.
Consistency, accountability (evidence of due diligence) and scale (new staff, systems and vendors inherit the rule).