164.314.pdf

§ 164.314 requires implementation of security measures, including access controls, audit controls, integrity, person or entity authentication, and transmission security. § 164.314 also outlines implementation specifications, such as unique user identification, emergency access procedures, automatic logoff, and encryption.

§ 164.314 Organizational requirements mandate business associate contracts or other arrangements that meet specific requirements, including compliance with applicable security requirements and reporting security incidents. Group health plans must ensure plan documents provide for reasonable safeguarding of electronic protected health information.

§ 164.316 requires covered entities and business associates to implement reasonable policies and procedures, maintain documentation, and review and update documentation periodically.

§ 164.318 sets compliance dates for initial implementation of security standards, with health plans required to comply by April 20, 2005, or April 20, 2006, for small health plans, and health care clearinghouses required to comply by a date not specified in the provided text.