Section § 164.414Administrative requirements and burden of proof

What it says

(a) Administrative requirements. A covered entity is required to comply with the administrative requirements of § 164.530(b), (d), (e), (g), (h), (i), and (j) with respect to the requirements of this subpart.

(b) Burden of proof. In the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach, as defined at § 164.402.

HIPAA, the United States rules protecting health information, § 164.414

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• XLSExcel

  HIPAA Documentation & Evidence Checklist

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Lists the documents and records to keep ready, the paragraph of the Rule behind each, and how long each must be kept.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• DOCWord

  Regulatory Notification Operating Procedure

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.