{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/us/agent/hipaa/administrative",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:228dcacd9c922f4b6db03714a793a82c64332a8e5b7696eeb969fd21830ceb75",
    "jurisdiction": "eu"
  },
  "layer": "us-agent-section",
  "agent": "hipaa",
  "slug": "administrative",
  "title": "Administrative safeguards",
  "reference": "45 CFR 164.308",
  "scope": "Risk analysis, workforce access, training and incident procedures.",
  "rule": "hipaa-security-rule",
  "identifier": "45 CFR Part 164, Subpart C",
  "jurisdiction_scope": [
    "federal"
  ],
  "risk_dimensions": [
    "privacy",
    "security",
    "operational"
  ],
  "tier": 1,
  "deterministic": true,
  "llm_used": false,
  "verdict_kind": "machine-classification",
  "official_source": "https://www.ecfr.gov/current/title-45/section-164.308",
  "register_source": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C",
  "cited_by": [
    {
      "ruleId": "hipaa-breach",
      "code": "hipaa-breach",
      "title": "Anmälningsskyldighet vid incident gäller",
      "titleEn": "The breach notification requirement applies",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.408 kräver anmälan till Health and Human Services utan oskäligt dröjsmål och senast 60 dagar efter upptäckt när minst 500 personer berörs. Underrättelse till den enskilde regleras i 45 CFR 164.404.",
      "obligationEn": "45 CFR 164.408 requires notice to Health and Human Services without unreasonable delay and no later than 60 days after discovery when at least 500 individuals are affected. Notice to the individual is governed by 45 CFR 164.404."
    },
    {
      "ruleId": "hipaa-ba",
      "code": "hipaa-ba-missing",
      "title": "Business associate-avtal saknas",
      "titleEn": "The business associate agreement is absent",
      "verdict": "förbjudet",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.308(b)(1) kräver ett skriftligt avtal innan en business associate skapar, tar emot, behåller eller överför elektronisk skyddad hälsoinformation för en täckt enhets räkning. Innehållet regleras i 45 CFR 164.314(a).",
      "obligationEn": "45 CFR 164.308(b)(1) requires a written contract before a business associate creates, receives, maintains or transmits electronic protected health information on behalf of a covered entity. The content is governed by 45 CFR 164.314(a)."
    },
    {
      "ruleId": "hipaa-risk",
      "code": "hipaa-risk-missing",
      "title": "Riskanalys saknas",
      "titleEn": "The risk analysis is absent",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.308(a)(1)(ii)(A) kräver en noggrann bedömning av risker och sårbarheter för konfidentialitet, integritet och tillgänglighet hos elektronisk skyddad hälsoinformation. Åtgärderna följer av 45 CFR 164.308(a)(1)(ii)(B).",
      "obligationEn": "45 CFR 164.308(a)(1)(ii)(A) requires an accurate assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. The measures follow from 45 CFR 164.308(a)(1)(ii)(B)."
    },
    {
      "ruleId": "hipaa-covered",
      "code": "hipaa-covered",
      "title": "Säkerhetsreglernas skyddsåtgärder gäller",
      "titleEn": "The security rule safeguards apply",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.306(a) kräver administrativa, fysiska och tekniska skyddsåtgärder för elektronisk skyddad hälsoinformation. De enskilda kraven står i 45 CFR 164.308, 164.310 och 164.312, och dokumentationen i 45 CFR 164.316.",
      "obligationEn": "45 CFR 164.306(a) requires administrative, physical and technical safeguards for electronic protected health information. The individual requirements are in 45 CFR 164.308, 164.310 and 164.312, and documentation in 45 CFR 164.316."
    }
  ],
  "checked_at": "2026-08-15",
  "canonical": "https://legal.exploreworldai.com/us/agent/hipaa/administrative",
  "agent_canonical": "https://legal.exploreworldai.com/us/agent/hipaa",
  "hash": "sha256:228dcacd9c922f4b6db03714a793a82c64332a8e5b7696eeb969fd21830ceb75",
  "citation": "45 CFR Part 164, Subpart C, HIPAA, Skyddad hälsoinformation. ExploreWorld Legal, https://legal.exploreworldai.com/us/agent/hipaa (hämtad 2026-08-15, bevis sha256:035c1dfa4597564c, bygge legal-2026-08-25).",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:228dcacd9c922f4b6db03714a793a82c64332a8e5b7696eeb969fd21830ceb75",
    "revalidate_after": "2026-08-30T08:47:00.761Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}