Develop and Implement Required Policies and Procedures It is necessary to develop and implement written policies and procedures that comply with federal laws governing the privacy of PHI. The policies and procedures should include, but not be limited to, the following: Notice of Privacy Practices: Providers are required to develop and provide individuals with their Notice of Privacy Practices. The notice should explain how the provider may use and disclose PHI, and the rights that individuals have to their PHI. A policy should be developed which outlines these requirements, including how the notice will be distributed. A dental practice paid $10,000 to the OCR for failing to have an adequate Notice of Privacy Practices in place.