You are working for a newly started healthcare company.

Write a policy recommendation about threats and vulnerabilities. Basically, what you think the IT policy should state. This can include how they should generate a privacy policy, HIPAA compliance policy, data retention and protection policy, auditing and compliance checks, job rotation policy, etc.

This should be about policy recommendations that are directly related to the four new requirements that are being addressed for the database. This should be focused on the specific policies that drive not only those decisions, but that dictate the entire security posture for the database. Relating it to HIPAA would be a good start - There are plenty of other security focused policies, overall and specific to healthcare that I'm sure you can find and reference.