[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR164.318]



[Page 750-751]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 164_SECURITY AND PRIVACY--Table of Contents

 

Subpart C_Security Standards for the Protection of Electronic Protected 

                           Health Information

 

Sec.  164.318  Compliance dates for the initial implementation of the 

security standards.



    (a) Health plan. (1) A health plan that is not a small health plan 

must comply with the applicable requirements of this subpart no later 

than April 20, 2005.

    (2) A small health plan must comply with the applicable requirements 

of this subpart no later than April 20, 2006.

    (b) Health care clearinghouse. A health care clearinghouse must 

comply with the applicable requirements of this subpart no later than 

April 20, 2005.

    (c) Health care provider. A covered health care provider must comply 

with the applicable requirements of this subpart no later than April 20, 

2005.



     Appendix A to Subpart C of Part 164--Security Standards: Matrix



----------------------------------------------------------------------------------------------------------------

                                                                                   Implementation Specifications

                 Standards                                 Sections                (R)=Required, (A)=Addressable

----------------------------------------------------------------------------------------------------------------

                                            Administrative Safeguards

----------------------------------------------------------------------------------------------------------------

Security Management Process................  164.308(a)(1)                        Risk Analysis (R)

                                             ...................................  Risk Management (R)

                                             ...................................  Sanction Policy (R)

                                             ...................................  Information System Activity

                                                                                   Review (R)

Assigned Security Responsibility...........  164.308(a)(2)                        (R)

Workforce Security.........................  164.308(a)(3)                        Authorization and/or

                                                                                   Supervision (A)

                                             ...................................  Workforce Clearance Procedure

                                             ...................................  Termination Procedures (A)

Information Access Management..............  164.308(a)(4)                        Isolating Health care

                                                                                   Clearinghouse Function (R)

                                             ...................................  Access Authorization (A)

                                             ...................................  Access Establishment and

                                                                                   Modification (A)

Security Awareness and Training............  164.308(a)(5)                        Security Reminders (A)

                                             ...................................  Protection from Malicious

                                                                                   Software (A)

                                             ...................................  Log-in Monitoring (A)

                                             ...................................  Password Management (A)

Security Incident Procedures...............  164.308(a)(6)                        Response and Reporting (R)

Contingency Plan...........................  164.308(a)(7)                        Data Backup Plan (R)

                                             ...................................  Disaster Recovery Plan (R)

                                             ...................................  Emergency Mode Operation Plan

                                                                                   (R)

                                             ...................................  Testing and Revision Procedure

                                                                                   (A)

                                             ...................................  Applications and Data

                                                                                   Criticality Analysis (A)

Evaluation.................................  164.308(a)(8)                        (R)

Business Associate Contracts and Other       164.308(b)(1)                        Written Contract or Other

 Arrangement.                                                                      Arrangement (R)

--------------------------------------------

                                               Physical Safeguards

----------------------------------------------------------------------------------------------------------------

Facility Access Controls...................  164.310(a)(1)                        Contingency Operations (A)

                                             ...................................  Facility Security Plan (A)

                                             ...................................  Access Control and Validation

                                                                                   Procedures (A)

                                             ...................................  Maintenance Records (A)

Workstation Use............................  164.310(b)                           (R)

Workstation Security.......................  164.310(c)                           (R)

Device and Media Controls..................  164.310(d)(1)                        Disposal (R)

                                             ...................................  Media Re-use (R)

                                             ...................................  Accountability (A)

                                             ...................................  Data Backup and Storage (A)

--------------------------------------------

                                    Technical Safeguards (see Sec.   164.312)

----------------------------------------------------------------------------------------------------------------

Access Control.............................  164.312(a)(1)                        Unique User Identification (R)

                                             ...................................  Emergency Access Procedure (R)

                                             ...................................  Automatic Logoff (A)

                                             ...................................  Encryption and Decryption (A)

Audit Controls.............................  164.312(b)                           (R)

Integrity..................................  164.312(c)(1)                        Mechanism to Authenticate

                                                                                   Electronic Protected Health

                                                                                   Information (A)

Person or Entity Authentication............  164.312(d)                           (R)

Transmission Security......................  164.312(e)(1)                        Integrity Controls (A)



[[Page 751]]





                                             ...................................  Encryption (A)

----------------------------------------------------------------------------------------------------------------



Subpart D [Reserved]