Section § 164.306Security standards: General rules

What it says

(a) General requirements. Covered entities and business associates must do the following:

(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.

(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.

(4) Ensure compliance with this subpart by its workforce.

(b) Flexibility of approach. (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.

(2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors:

(i) The size, complexity, and capabilities of the covered entity or business associate.

(ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities.

(iii) The costs of security measures.

(iv) The probability and criticality of potential risks to electronic protected health information.

(c) Standards. A covered entity or business associate must comply with the applicable standards as provided in this section and in §§ 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.

(d) Implementation specifications. In this subpart:

(1) Implementation specifications are required or addressable. If an implementation specification is required, the word “Required” appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word “Addressable” appears in parentheses after the title of the implementation specification.

(2) When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications.

(3) When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes addressable implementation specifications, a covered entity or business associate must—

(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and

(ii) As applicable to the covered entity or business associate—

(A) Implement the implementation specification if reasonable and appropriate; or

(B) If implementing the implementation specification is not reasonable and appropriate—

$(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and

$(2) Implement an equivalent alternative measure if reasonable and appropriate.

(e) Maintenance. A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with § 164.316(b)(2)(iii).

HIPAA, the United States rules protecting health information, § 164.306

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  Security Rule Safeguard Register

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Lists the 22 Security Rule standards and their 41 implementation specifications in plain words, required or addressable, with an owner and the evidence to keep.
• DOCWord

  Security Risk Analysis Method

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Sets out a repeatable method for the security risk analysis: the inventory of electronic patient information, threats, vulnerabilities, ratings and the signed record.
• XLSExcel

  HIPAA Documentation & Evidence Checklist

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Lists the documents and records to keep ready, the paragraph of the Rule behind each, and how long each must be kept.
• XLSExcel

  HIPAA Gap & Remediation Tracker

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Tracks the gaps found against the readiness items, with priority, owner, deadline and status.
• XLSExcel

  HIPAA Security Rule Readiness Self-Assessment

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Rates readiness against the Security Rule items and returns the blocking gaps, in counts and with no score.
• PPTPowerPoint

  HIPAA Management Briefing Deck

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Tells leaders what HIPAA asks of security, what must be shown, and the six decisions needed from them.
• DOCWord

  Business Continuity & ICT Resilience Policy

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this section's rule for addressable implementation specifications. Commits the organisation to continuity and recovery objectives; the resilience domain's single policy.