Administrative Safeguards
Policies and procedures to manage workforce conduct around ePHI.
Security Management Process
Implement policies and procedures to prevent, detect, contain, and correct security violations. Risk Analysis (Required), Risk Management (R), Sanction Policy (R), Information System Activity Review (R).
Assigned Security Responsibility
Identify the security official responsible for the development and implementation of policies and procedures.
Workforce Security
Authorization and/or supervision (Addressable), Workforce clearance procedure (A), Termination procedures (A).
Information Access Management
Isolating health care clearinghouse function (R), Access authorization (A), Access establishment and modification (A).
Security Awareness and Training
Security reminders (A), Protection from malicious software (A), Log-in monitoring (A), Password management (A).
Security Incident Procedures
Response and Reporting (R) — identify and respond to suspected or known security incidents.
Contingency Plan
Data backup plan (R), Disaster recovery plan (R), Emergency mode operation plan (R), Testing and revision (A), Applications and data criticality analysis (A).
Evaluation
Periodic technical and nontechnical evaluation of security safeguards.
Business Associate Contracts
Written contract or other arrangement with business associates that meet requirements.