Section § 164.308(a)(6)Security incident procedures

(6)(i) Standard: Security incident procedures. Implement policies and procedures to address security incidents.

(ii) Implementation specification: Response and reporting (Required). Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

HIPAA, the United States rules protecting health information, § 164.308(a)(6)

Text: 45 CFR Part 164, from the Electronic Code of Federal Regulations (eCFR) as it stood on 6 October 2026.