← All documentation

Policy library and drafting

Your policies can start from the built-in AI policy library — ten templates, from the AI Governance Charter to the AI Incident Response Policy — or the HIPAA policy library, from information security and privacy to breach notification, or be drafted by Watney from your organization's own context.

Adopting from the library, as a set

Choose Start from a template on a new policy. Each template's statements are tagged with the framework controls they address, and the policy saves as a draft for you to review.

Templates depend on each other for their defined terms: the Acceptable Use Policy, for example, uses "system owner" from the AI Governance Charter and "risk tier" from the AI Risk Management Policy. When a template relies on policies you do not have yet, the form offers them, ticked, and adopts them as drafts with it. Untick any you already cover another way. Nothing is adopted without being shown.

A policy's page also names, from its own text as it now stands, each policy whose defined terms it uses that your organization has not adopted (a retired policy does not count), with the terms it uses, and admins get a link to start that policy from its template.

Drafting with Watney

  1. On the Policies page, click ✨ Draft with Watney (org admins, when AI is enabled).
  2. Pick a policy type and generate. The AI governance policies are always offered; when your organization runs a HIPAA program, the HIPAA areas (security, privacy, breach notification, workforce, device and media, contingency, audit controls and facility access) are offered too, and a HIPAA draft is written for your answer to whether you are a covered entity, a business associate or both. Watney drafts a full, sectioned policy tailored to your team size, vendors and assessment posture, inserting [PLACEHOLDER: …] markers wherever a specific fact is required but not known.
  3. Review the preview, then Save as draft policy. It lands in your library with draft status and version 0.1.

Checking policies against your answers

Check for drift (org admins, when AI is enabled) compares what your active policies commit to with what your own assessments say. Watney reads each policy statement that names framework controls beside your latest answers on those controls, and reports only a specific commitment an answer contradicts, with both sides, so you can decide whether the policy or the answer is out of date. For a statement of a HIPAA policy area it also reads your latest approved organization-wide HIPAA risk analysis: the scenarios you decided to mitigate, with their planned controls, and reports a statement that commits to less than a control the analysis plans for the same risk. It sends the statements, the questions and your answer values (never your answer notes), and the analysis's asset, threat and planned controls. It changes nothing.

Grounding & safety

  • The model receives your organization's name and aggregate context (counts and posture summaries), plus the text you supply: your drafting instruction and the current policy's own headings and body. Those are free text, so they may contain personal data, and they are sent to the AI model provider to produce the draft.
  • Watney is instructed not to claim your organization performs a control it hasn't indicated, and to use placeholders for unknown facts; check the draft for any statement your organization cannot support.
  • The output is always a draft. Complete every placeholder, edit for your environment, and obtain legal/compliance sign-off before activating it — saving a draft never activates a policy.

Publishing it

A policy can't jump from draft straight to active. It has to pass through In review first, because a policy should be reviewed before it is adopted — and once a policy is active you can send it to your workforce to acknowledge. A signed acknowledgment of text nobody reviewed is weaker evidence than no policy at all.

So the route is Draft → In review → Active, set in the policy editor. On the list, selecting policies offers Submit for review (move to In review), Publish (make active) and Archive (retire) for several at once, and each policy must be allowed to make that move. Activating also requires that no [PLACEHOLDER: …] marker remains and that a next review date is set.

You can retire a policy from any state. A retired policy can come back as a draft or go In review, but never straight to active — a reinstatement gets the same scrutiny as a new publication. Restoring an older version deliberately returns the policy to draft for the same reason.

Workforce sanctions

Workforce sanctions (a tab of Policies, for organization administrators) records each sanction applied to a workforce member who did not comply with your security or privacy policies and procedures, or with a HIPAA requirement. The HIPAA Security Rule requires a covered entity or business associate to apply appropriate sanctions against workforce members who fail to comply with its security policies and procedures (45 CFR § 164.308(a)(1)(ii)(C)). The Privacy Rule requires a covered entity to have and apply appropriate sanctions against workforce members who fail to comply with its privacy policies and procedures or with the Privacy or Breach Notification Rules, and to document the sanctions it applies (§ 164.530(e)). Whether, and in what capacity, these apply to your organization is for you to determine and document. This register documents the sanctions applied; your sanction policy itself belongs in Policies.

Each record names the workforce member: chosen from your members, or typed for someone without an account. Workforce means employees, volunteers, trainees and other persons whose conduct, in the performance of work for you, is under your direct control, whether or not you pay them (45 CFR § 160.103). It records the date of the violation, what happened, the policy that was not complied with (from your library, retired policies included, or described), the sanction applied (a verbal or written warning, retraining, suspension, termination or other) and the date it was applied. Describe any health information involved without copying it into the record. The policy link points to the policy's record, not to the version in effect on the violation date.

Before you apply a sanction, check whether the conduct is protected. The Privacy Rule's sanctions standard does not apply to a disclosure that meets the conditions of 45 CFR § 164.502(j) (a whistleblower's good-faith disclosure to a health oversight agency, a public health authority, an accreditation organization or their own attorney, or a disclosure by a workforce member who is a crime victim to law enforcement), or to filing a complaint, taking part in an investigation or opposing a practice the rules make unlawful (§§ 164.530(g)(2), 160.316). Retaliation for those acts is itself prohibited. Record how you checked this in the notes.

Correcting a sanction keeps what the record said before: each earlier reading is listed under the record, and who first recorded it never changes. Removing one is only for a sanction recorded in error, such as a duplicate or the wrong person, and asks why; it is kept, with the reason, but no longer listed or exported from this page, and it stays in your organization's full data export.

A covered entity keeps this documentation for six years from the date it was created or the date it was last in effect, whichever is later (45 CFR § 164.530(j)(2)). Backsplice keeps it while your account is open; export your organization's data before closing it. The register is not part of any auditor's scope, because it names people and what they did; on a paid plan, export it as a CSV when an auditor asks for it.