Should we have a seperate policy dealing with this issue or will our Information System Policy, which says the same thing, cover this issue.

As long as your Info System Policy covers what you need to do in the event of access to cust data I see no need for a separate policy. Just ensure that it is complete, since this is a new "hot button" issue with the regulators.