Section § 164.316(a)Policies and procedures

(a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.

HIPAA, the United States rules protecting health information, § 164.316(a)

Text: 45 CFR Part 164, from the Electronic Code of Federal Regulations (eCFR) as it stood on 6 October 2026.