This sample outlines a set of policies and procedures regarding covered entities obtaining authorization to use or disclose protected health information (PHI) for health oversight purposes authorized by law (e.g. HIPAA), including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings; or other oversight activities.