I found this book helpful: The HIPAA Roadmap for Business Associates ( http://www.amazon.com/gp/product/1484067010/ref=oh_aui_searc... ). It goes through some of the basics of HIPAA, what kinds of policies you need to have and why, and includes some example policy templates similar to the ones being graciously provided in this article.