Theory: Anatomy & Language of a Good Policy
Two policies can cover the same risk: one gets followed, the other gets ignored. The difference lies in structure (does the document contain everything needed to make it work?) and language (is every requirement mandatory, measurable and understandable?). This lesson gives the six-part anatomy to check before approving or writing a policy, the five principles of strong policy language, and a complete worked policy for MediCare Plus Hospital.
The Six Parts of a Good Policy
Anatomy of a good policy: check for all six parts.
- Purpose: why this policy exists; usually traces to a risk or legal requirement.
- Scope: who and what systems must comply. Be specific (“clinical staff with EHR access”), not just “all staff”.
- Policy Statement: the actual mandatory requirement(s); the core of the document.
- Roles & Responsibilities: who owns, enforces and is accountable for compliance (named roles, not departments).
- Compliance & Enforcement: what happens if the policy is not followed.
- Review Date: when the policy will next be reviewed; ties back to the policy lifecycle (see 4.2).
Diagram loads as you scroll.
| Missing part | What goes wrong |
|---|
| Purpose | Staff don’t understand why the rule matters and treat it as bureaucracy |
| Scope | Nobody knows whether contractors, vendors or specific systems are covered |
| Statement | There is no actual rule to follow |
| Roles | Nobody is accountable, so nobody enforces it |
| Compliance | Breaking the rule has no consequence |
| Review Date | The policy silently goes stale |
Five Principles of Strong Policy Language
| Principle | Rule | Weak → Strong |
|---|
| Mandatory | Use “must” / “shall”, not “should” / “may”, for anything non-negotiable | “Staff should try to lock screens” → “Staff must lock screens when unattended.” |
| Specific & Measurable | Avoid vague terms like “reasonable” or “as needed”; state a number, timeframe or clear condition | “Review access periodically” → “Review access every 90 days.” |
| Enforceable | Someone must be able to check compliance; if you can’t audit it, it isn’t a real requirement | “Be careful with patient data” → “All PHI exports are logged and reviewed monthly.” |
| Clear to Non-Technical Staff | Most people bound by the policy aren’t IT; avoid jargon so a nurse understands it on first read | “Enforce AES-256 at rest” → “All hospital laptops must have encryption enabled (IT will assist).” |
| Practical | Will people actually follow it? An unrealistic rule often produces worse security | Passwords of 16 characters changed monthly → staff write them on sticky notes on monitors |
(PHI = protected health information, i.e. patient health data.)
Words that weaken a policy: should, may, try to, reasonable, appropriate, as needed, as soon as possible, where possible, periodically. Each one lets a reader decide for themselves whether the rule applies, which makes it impossible to enforce. Replace each with must/shall plus a number, deadline or condition.
“Practical” is the principle students forget. A stricter rule is not automatically a better one: if staff cannot realistically follow it, they find a workaround, and the workaround is usually less secure than a sensible rule would have been.
Worked Example: A Complete Policy
This policy closes the risk “shared login used by multiple nurses on ward workstations” (see 4.2).
ACCESS CONTROL POLICY: MediCare Plus Hospital
Purpose: To ensure that access to patient information systems is limited to authorized, individually identifiable users, reducing the risk of unauthorized or untraceable access.
Scope: Applies to all MediCare Plus employees, contractors, and vendors with access to the Electronic Health Record (EHR) system or any workstation on the clinical network.
Policy Statement: All users must access clinical systems using individually assigned credentials. Shared or generic accounts are prohibited, except pre-approved emergency “break-glass” access, which must be logged and reviewed within 24 hours.
Roles & Responsibilities: IT Manager: provisions and revokes access. Department Heads: approve access requests for their staff. CISO: audits compliance quarterly.
Compliance & Enforcement: Violations are reported to the CISO and may result in access suspension and disciplinary action per HR policy.
Review Date: This policy is reviewed annually, or immediately following any related security incident.
Why it is good:
- Purpose names the risk it addresses (untraceable access).
- Scope is specific: employees, contractors and vendors, and names the systems (EHR, clinical-network workstations).
- Statement uses “must” and “prohibited”, and handles a realistic exception (break-glass emergency access) with a measurable control (logged, reviewed within 24 hours). Allowing emergency access keeps the rule practical in a hospital.
- Roles name specific roles with specific duties.
- Compliance states real consequences (access suspension, disciplinary action).
- Review Date gives both a schedule (annually) and a trigger (after a related incident).
The Same Anatomy, Four Levels
The six-part structure works at every level of the hierarchy (see 4.1). Purpose, Scope, Roles, Compliance and Review Date barely change; what changes is the statement itself.
For the risk “shared login used by multiple nurses on ward workstations: Critical”, with Purpose and Scope at every level being “protect patient data by ensuring individual accountability for all clinical-network users”:
| Level | Statement |
|---|
| Policy | “All clinical systems must ensure that access is individually attributable to a named user.” |
| Standard | “Shared or generic login accounts are prohibited on any workstation with EHR access.” |
| Procedure | “IT disables generic accounts and issues individual logins during onboarding, step by step per the Access Provisioning checklist.” |
| Guideline | “Staff are encouraged to log out, not just lock workstations, at shift change to reinforce individual accountability.” |
In this course you draft at the Policy or Standard level; Procedure and Guideline remain conceptual.
Worked Examples
Exercise 1
Rewrite each weak policy statement so that it is mandatory, specific and enforceable. Name the principle(s) each original breaks.
a) “Staff should report lost hospital phones as soon as possible.”
b) “IT will review user access as needed.”
c) “Employees must use reasonable care when emailing patient information.”
Show solution ↓Hide solution ↑
Solution
a) Breaks: Mandatory (“should”) and Specific (“as soon as possible” has no deadline).
Rewrite: “Staff must report a lost or stolen hospital phone to the IT help desk within 1 hour of noticing it is missing.”
b) Breaks: Specific & Measurable (“as needed” lets IT decide never to do it), and therefore Enforceable.
Rewrite: “The IT Manager must review all user access rights every 90 days and record the review in the access log.”
c) Breaks: Specific and Enforceable (“reasonable care” cannot be checked).
Rewrite: “Patient information must only be emailed using the hospital’s encrypted email option; all such emails are logged and reviewed monthly by the CISO.”
Each rewrite uses “must”, adds a number or clear condition, and names something an auditor can check.
Exercise 2
Identify which of the six parts are missing from this draft, and write the missing parts.
Clean Desk Policy. Purpose: To protect patient information on paper from being seen by unauthorized people. Policy Statement: Staff must remove all patient documents from their desks and lock them in a drawer when leaving the desk for more than 10 minutes and at the end of every shift. Compliance & Enforcement: Violations will be recorded and repeated violations will lead to disciplinary action per HR policy.
Show solution ↓Hide solution ↑
Solution
Check against the six-part list: Purpose ✓, Scope ✗, Policy Statement ✓, Roles & Responsibilities ✗, Compliance & Enforcement ✓, Review Date ✗.
Missing: Scope, Roles & Responsibilities, and Review Date. Model additions:
- Scope: “Applies to all MediCare Plus employees, contractors and volunteers who handle printed patient information in any ward, clinic or administrative office.”
- Roles & Responsibilities: “Department Heads enforce this policy in their areas and carry out weekly spot checks. The CISO owns the policy and reviews spot-check results quarterly. All staff must comply.”
- Review Date: “This policy is reviewed annually, or immediately after any incident involving exposed paper records.”
Exercise 3
(Mini-case) MediCare Plus’s new standard requires: “All clinical-system passwords must be 16 characters long and changed every month.” Within weeks, auditors find passwords written on sticky notes on many ward monitors. Which principle of strong policy language did the standard violate, and how should it be fixed?
Show solution ↓Hide solution ↑
Solution
- The standard is mandatory, specific and enforceable, but it is not Practical: busy clinical staff cannot memorise a new 16-character password every month.
- Staff found a workaround (sticky notes), which exposes passwords to anyone walking past: the rule produced worse security than a moderate rule would have.
- A fix keeps strength while making compliance realistic, for example: require a long passphrase that is changed only when compromise is suspected, combined with multi-factor authentication (such as a badge tap) on clinical systems. Then add a measurable check: “IT checks ward workstations for written passwords during monthly walk-rounds.”
The standard violated the Practical principle; replace it with a realistic rule (e.g. passphrase plus MFA, no forced monthly change) that staff will actually follow.
Exercise 4
The statement “All laptops must use full-disk encryption with AES-256 and TPM-backed key storage” is mandatory, specific and enforceable. Which principle does it break if it appears in a policy aimed at all hospital staff? Rewrite it.
Show solution ↓Hide solution ↑
Solution
- “AES-256” and “TPM-backed key storage” are technical jargon. A nurse or administrator reading it cannot tell what they are supposed to do.
- It breaks Clear to Non-Technical Staff.
- The technical detail can move into an IT-owned standard or procedure; the staff-facing text should say what staff must do in plain language.
Rewrite: “All hospital laptops must have encryption enabled before they are used outside the hospital. If you are not sure whether your laptop is encrypted, contact IT, who will check and enable it for you.”
Exercise 5
(Conceptual) In the worked Access Control Policy, the statement allows “pre-approved emergency break-glass access, which must be logged and reviewed within 24 hours.” Why include an exception at all, and why does the way it is written keep the policy enforceable?
Show solution ↓Hide solution ↑
Solution
- Why include it (Practical): in a hospital, an emergency (e.g. a patient arriving in critical condition when the assigned clinician’s account is locked) may require immediate access. A rule with no exception would force staff to choose between the patient and the policy, and they would invent unsafe workarounds such as sharing passwords.
- Why it stays enforceable: the exception is pre-approved (not improvised), every use is logged, and every log entry must be reviewed within 24 hours. An auditor can check each condition, so misuse of the exception would be detected.
The exception makes the policy practical for real emergencies, and the logging plus 24-hour review keeps it specific, auditable and therefore enforceable.