HIPAA Covered Entities are required to develop policies and procedures based on an analysis of a risk assessment. As each Covered Entity is unique, it is likely each will identify unique threats to the privacy of patient health information and develop different policies and procedures – including different HIPAA telephone rules – to mitigate the threat of an unauthorized disclosure.