45 CFR 164.312 - Technical safeguards.

A covered entity or business associate must, in accordance with § 164.306:

(a)

(1)Standard: Access control. Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).

(2)Implementation specifications:

(i)Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.

(ii)Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.

(iii)Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

(iv)Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.

(b)Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

(c)

(1)Standard: Integrity. Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

(2)Implementation specification: Mechanism to authenticate electronic protected health information (Addressable). Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.

(d)Standard: Person or entity authentication. Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.

(e)

(1)Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.

(2)Implementation specifications:

(i)Integrity controls (Addressable). Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.

(ii)Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.

[ 68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

Title 45 published on 03-Jun-2017 03:14

The following are ALL rules, proposed rules, and notices (chronologically) published in the Federal Register relating to 45 CFR Part 164 after this date.

  • 2016-01-06; vol. 81 # 3 - Wednesday, January 6, 2016
    1. 81 FR 382 - Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the National Instant Criminal Background Check System (NICS)
      GPO FDSys XML | Text
      DEPARTMENT OF HEALTH AND HUMAN SERVICES, Office of the Secretary
      Final rule.
      Effective date: This final rule is effective on February 5, 2016.
      45 CFR Part 164
The section you are viewing is cited by the following CFR sections.