Section § 164.308(a)(8)Evaluation

(8) Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.

HIPAA, the United States rules protecting health information, § 164.308(a)(8)

Text: 45 CFR Part 164, from the Electronic Code of Federal Regulations (eCFR) as it stood on 6 October 2026.