The compliance officer with a hospital system is responsible for writing and implementing all policies and procedures for the system. During a gap analysis and risk assessment, the compliance officer learns that there is not an updated policy on use and disclosure of PHI for treatment, payment, and operations. A policy needs to be drafted so that everyone from the gardener to the c-suite can understand what is trying to be accomplished with this policy to manage access to the information. The review 45 CFR 164.501, 164.506, and 164.512 respectively will assist in better understanding.