45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards

What this rule requires your agency to do

• 1The covered entity or business associate must implement a security management process — policies and procedures to prevent, detect, contain, and correct security violations — including a required risk analysis of risks to the confidentiality, integrity, and availability of ePHI, risk management measures, a sanction policy against noncompliant workforce members, and regular information system activity review (subd. a(1)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 2The entity must implement workforce security policies and procedures — including authorization/supervision, workforce clearance, and termination procedures — to ensure appropriate access to ePHI and prevent access by workforce members who should not have it (subd. a(3)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 3The entity must implement information access management policies and procedures consistent with the Privacy Rule, including isolating clearinghouse functions and establishing, documenting, reviewing, and modifying user access (subd. a(4)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 4The entity must implement security incident procedures to identify and respond to suspected or known security incidents, mitigate to the extent practicable their harmful effects, and document security incidents and their outcomes (subd. a(6)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 5The covered entity or business associate must identify the security official responsible for developing and implementing the security policies and procedures required by this subpart (subd. a(2)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 6A covered entity or business associate may permit a business associate or subcontractor to create, receive, maintain, or transmit ePHI on its behalf only after obtaining satisfactory assurances (documented through a written contract or other arrangement meeting § 164.314(a)) that the information will be appropriately safeguarded (subd. b).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 7The entity must establish and implement a contingency plan (data backup, disaster recovery, emergency mode operation, and, as addressable, testing/revision and applications/data criticality analysis) and must perform a periodic technical and nontechnical evaluation of the extent to which its security policies and procedures meet this subpart (subds. a(7)-(8)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)
• 8The entity must implement a security awareness and training program for all workforce members (including management), addressing security reminders, protection from malicious software, log-in monitoring, and password management (subd. a(5)).(45 CFR 164.308 — HIPAA Security Rule: Administrative Safeguards)