[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR160.310]



[Page 712-713]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 160_GENERAL ADMINISTRATIVE REQUIREMENTS--Table of Contents

 

                 Subpart C_Compliance and Investigations

 

Sec.  160.310  Responsibilities of covered entities.



    (a) Provide records and compliance reports. A covered entity must 

keep such records and submit such compliance reports, in such time and 

manner and containing such information, as the Secretary may determine 

to be necessary to enable the Secretary to ascertain whether the covered 

entity has complied or is complying with the applicable administrative 

simplification provisions.

    (b) Cooperate with complaint investigations and compliance reviews. 

A covered entity must cooperate with the Secretary, if the Secretary 

undertakes an investigation or compliance review of the policies, 

procedures, or practices of the covered entity to determine whether it 

is complying with the applicable administrative simplification 

provisions.

    (c) Permit access to information. (1) A covered entity must permit 

access by the Secretary during normal business hours to its facilities, 

books, records, accounts, and other sources of information, including 

protected health information, that are pertinent to



[[Page 713]]



ascertaining compliance with the applicable administrative 

simplification provisions. If the Secretary determines that exigent 

circumstances exist, such as when documents may be hidden or destroyed, 

a covered entity must permit access by the Secretary at any time and 

without notice.

    (2) If any information required of a covered entity under this 

section is in the exclusive possession of any other agency, institution, 

or person and the other agency, institution, or person fails or refuses 

to furnish the information, the covered entity must so certify and set 

forth what efforts it has made to obtain the information.

    (3) Protected health information obtained by the Secretary in 

connection with an investigation or compliance review under this subpart 

will not be disclosed by the Secretary, except if necessary for 

ascertaining or enforcing compliance with the applicable administrative 

simplification provisions, or if otherwise required by law.