hipaa Controls

Implement a security management process to prevent, detect, contain, and correct security violations

Designate a security official responsible for developing and implementing security policies and procedures

Implement procedures to ensure workforce members have appropriate access to ePHI and prevent unauthorized access

Implement policies and procedures for authorizing access to ePHI

Implement a security awareness and training program for all workforce members

Implement policies and procedures to address security incidents involving ePHI

Establish and implement contingency plans to respond to emergencies that damage systems containing ePHI

Perform periodic technical and non-technical evaluations of security controls in response to environmental or operational changes

Obtain satisfactory assurances from business associates that they will appropriately safeguard ePHI

Ensure contracts or other arrangements with business associates meet HIPAA requirements and provide satisfactory assurances of ePHI protection

Implement reasonable and appropriate policies and procedures to comply with the HIPAA Security Rule

Maintain written security policies, procedures, and records for six years from creation or last effective date

Implement policies and procedures to limit physical access to electronic information systems and the facilities where they are housed

Specify the proper functions to be performed by workstations that access ePHI and the manner in which those functions are to be performed

Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users

Implement policies and procedures governing the receipt, removal, and disposal of hardware and electronic media containing ePHI

Implement technical policies and procedures to allow access to ePHI only to authorized persons or software programs

Implement hardware, software, and procedural mechanisms that record and examine activity in systems containing ePHI

Implement policies and procedures to protect ePHI from improper alteration or destruction

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be

Implement technical security measures to guard against unauthorized access to ePHI transmitted over electronic communications networks