HIPAA Controls Knowledge Base

A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures....

Implement policies and procedures to ensure that all members of the workforce have appropriate access to electronic protected health information (ePHI...

Implement policies and procedures for authorizing access to ePHI that are consistent with the applicable requirements of the Security Rule....

Implement a security awareness and training program for all members of the workforce (including management)....

Implement policies and procedures to address security incidents....

Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system f...

Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in respons...

Implement policies and procedures to limit physical access to electronic information systems and the facility or facilities in which they are housed, ...

Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the ...

Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users....

Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, a...

Implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored....

Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software pr...

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI....

Implement policies and procedures to protect ePHI from improper alteration or destruction....

Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed....

Implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network...

A covered entity may permit a business associate to create, receive, maintain, or transmit ePHI on the covered entity's behalf only if the covered ent...

Except when the only ePHI disclosed to a plan sponsor is disclosed pursuant to 164.504(f)(1)(ii) or (iii), or as permitted under 164.508(a)(3)(i), a g...

Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of thi...

Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form....

Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect...