[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR164.306]



[Page 744-745]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 164_SECURITY AND PRIVACY--Table of Contents

 

Subpart C_Security Standards for the Protection of Electronic Protected 

                           Health Information

 

Sec.  164.306  Security standards: General rules.



    (a) General requirements. Covered entities must do the following:

    (1) Ensure the confidentiality, integrity, and availability of all 

electronic protected health information the covered entity creates, 

receives, maintains, or transmits.

    (2) Protect against any reasonably anticipated threats or hazards to 

the security or integrity of such information.

    (3) Protect against any reasonably anticipated uses or disclosures 

of such information that are not permitted or required under subpart E 

of this part.

    (4) Ensure compliance with this subpart by its workforce.

    (b) Flexibility of approach. (1) Covered entities may use any 

security measures that allow the covered entity to reasonably and 

appropriately implement the standards and implementation specifications 

as specified in this subpart.

    (2) In deciding which security measures to use, a covered entity 

must take into account the following factors:

    (i) The size, complexity, and capabilities of the covered entity.

    (ii) The covered entity's technical infrastructure, hardware, and 

software security capabilities.

    (iii) The costs of security measures.

    (iv) The probability and criticality of potential risks to 

electronic protected health information.

    (c) Standards. A covered entity must comply with the standards as 

provided in this section and in Sec.  164.308, Sec.  164.310, Sec.  

164.312, Sec.  164.314, and Sec.  164.316 with respect to all electronic 

protected health information.

    (d) Implementation specifications. In this subpart:

    (1) Implementation specifications are required or addressable. If an 

implementation specification is required, the word ``Required'' appears 

in parentheses after the title of the implementation specification. If 

an implementation specification is addressable, the word ``Addressable'' 

appears in parentheses after the title of the implementation 

specification.

    (2) When a standard adopted in Sec.  164.308, Sec.  164.310, Sec.  

164.312, Sec.  164.314, or Sec.  164.316 includes required 

implementation specifications, a covered entity must implement the 

implementation specifications.

    (3) When a standard adopted in Sec.  164.308, Sec.  164.310, Sec.  

164.312, Sec.  164.314, or Sec.  164.316 includes addressable 

implementation specifications, a covered entity must--

    (i) Assess whether each implementation specification is a reasonable 

and appropriate safeguard in its environment, when analyzed with 

reference to the likely contribution to protecting



[[Page 745]]



the entity's electronic protected health information; and

    (ii) As applicable to the entity--

    (A) Implement the implementation specification if reasonable and 

appropriate; or

    (B) If implementing the implementation specification is not 

reasonable and appropriate--

    $(1) Document why it would not be reasonable and appropriate to 

implement the implementation specification; and

    $(2) Implement an equivalent alternative measure if reasonable and 

appropriate.

    (e) Maintenance. Security measures implemented to comply with 

standards and implementation specifications adopted under Sec.  164.105 

and this subpart must be reviewed and modified as needed to continue 

provision of reasonable and appropriate protection of electronic 

protected health information as described at Sec.  164.316.



[68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003]