The IRS has a sample plan to modify to meet the needs of your practice. https://www.irs.gov/newsroom/security-summit-releases-new-data-security-plan-to-help-tax-professiona...
