This sample outlines a set of policies and procedures governing the handling of Protected Health Information (PHI) in compliance with HIPAA security provisions. This policy must be followed when performing services for a client that is a Covered Entity or a Business Associate of a Covered Entity.