Policy Drafting

Ryland can draft a starting-point HIPAA policy — an Incident Response Plan, a Sanction Policy, a Contingency Plan, and more — seeded from your organization's own context rather than a generic template.

How it works

1. On the Policies page, click ✨ Draft with Ryland (org admins, when AI is enabled).
2. Pick a policy type and generate. Ryland drafts a full, sectioned policy tailored to your team size, locations, and assessment posture, inserting [PLACEHOLDER: …] markers wherever a specific fact is required but not known.
3. Review the preview, then Save as draft policy. It lands in your library with draft status and version 0.1.

Grounding & safety

• The model receives only aggregate, non-PHI context (counts and posture summaries) — never patient data.
• Ryland will not claim your organization performs a control it hasn't indicated; unknown facts become placeholders.
• The output is always a draft. Complete every placeholder, edit for your environment, and obtain legal/compliance sign-off before activating it — saving a draft never activates a policy.

Publishing it

A policy can't jump from draft straight to active. It has to pass through under review first, because §164.316(a) expects policies to be reviewed before they're adopted — and once a policy is active you can send it to your workforce to acknowledge. A signed acknowledgment of text nobody reviewed is weaker evidence than no policy at all.

So the route is Draft → Under Review → Active, from the policy editor or by selecting policies on the list and changing their status together. Activating also requires that no [PLACEHOLDER] text remains and that a next review date is set.

You can retire a policy from any state. A retired policy can come back as a draft or go under review, but never straight to active — a reinstatement gets the same scrutiny as a new publication. Restoring an older version deliberately returns the policy to draft for the same reason.