To better serve anyone who may contact me regarding their compliance needs in order to figure out whether I am the right person to work with, I just posted a high-level compliance program overview diagram to our site's new Resources page.

(Don't worry—the picture above is NOT it.)

The diagram will show you the approach I normally take to the compliance consulting work I do, whether that is creating documentation, helping define governance processes, or dealing with awareness training needs for staff and other stakeholders.

The diagram illustrates the high-level lifecycle for creation of a complete, new compliance program.

This is the first in a small series on some key reasons why written policy and procedure documentation is important to your small business or medical or dental practice, no matter how small you may be.

Not many of the smallest businesses that I commonly work with have yet to purchase cyber insurance but it's becoming more popular, quickly, especially with data-intensive businesses and those facing clear and strong information protection rules such as HIPAA-regulated healthcare entities and even their business associates.

When it comes time to purchase cybersecurity insurance, odds are that you will be expected to have a defined compliance program that includes comprehensive written privacy and security policies and procedures.

It isn’t uncommon for businesses to have real rules and defined procedures that impact compliance but that are not written down. You could have a valid compliance program that is not all in writing.

I won’t be trying to convince people that they absolutely HAVE to spend money and precious time documenting businesses policies and procedures to satisfy a regulator who may have little likelihood to pay them a visit.

But there are several other reasons why small business owners should spend their money and someone’s precious time to create at least a basic set a business policies and procedures for their business or healthcare practice. And they're reasons that usually have bottom-line financial impacts.