Administrative safeguards

Outcomes resting on this section

The rules below point to this section in their outcome. The verdict is a machine classification, not a judgment on an individual matter.

• hipaa-breach

  The breach notification requirement applies

  45 CFR 164.408 requires notice to Health and Human Services without unreasonable delay and no later than 60 days after discovery when at least 500 individuals are affected. Notice to the individual is governed by 45 CFR 164.404.

  risk, Requirement applies

• hipaa-ba

  The business associate agreement is absent

  45 CFR 164.308(b)(1) requires a written contract before a business associate creates, receives, maintains or transmits electronic protected health information on behalf of a covered entity. The content is governed by 45 CFR 164.314(a).

  prohibited, Requirement applies

• hipaa-risk

  The risk analysis is absent

  45 CFR 164.308(a)(1)(ii)(A) requires an accurate assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. The measures follow from 45 CFR 164.308(a)(1)(ii)(B).

  risk, Requirement applies

• hipaa-covered

  The security rule safeguards apply

  45 CFR 164.306(a) requires administrative, physical and technical safeguards for electronic protected health information. The individual requirements are in 45 CFR 164.308, 164.310 and 164.312, and documentation in 45 CFR 164.316.

  risk, Requirement applies

Section nodes

• Physical safeguards45 CFR 164.310
• Technical safeguards45 CFR 164.312
• Business associate contracts45 CFR 164.314