HIPAA Security Rule: the evidence behind every control
67 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
Administrative
164.306Security Standards: General Rules hard164.308(a)(1)(i)Security Management Process (Standard) hard164.308(a)(1)(ii)(A)Risk Analysis (Required) hard164.308(a)(1)(ii)(B)Risk Management (Required) easy164.308(a)(1)(ii)(C)Sanction Policy (Required) moderate164.308(a)(1)(ii)(D)Information System Activity Review (Required) moderate164.308(a)(2)Assigned Security Responsibility (Standard) hard164.308(a)(3)(i)Workforce Security (Standard) hard164.308(a)(3)(ii)(A)Authorization and Supervision (Addressable) moderate164.308(a)(3)(ii)(B)Workforce Clearance Procedure (Addressable) hard164.308(a)(3)(ii)(C)Termination Procedures (Addressable) moderate164.308(a)(4)(i)Information Access Management (Standard) hard164.308(a)(4)(ii)(A)Isolating Health Care Clearinghouse Functions (Required if applicable) moderate164.308(a)(4)(ii)(B)Access Authorization (Addressable) easy164.308(a)(4)(ii)(C)Access Establishment and Modification (Addressable) moderate164.308(a)(5)(i)Security Awareness and Training (Standard) hard164.308(a)(5)(ii)(A)Security Reminders (Addressable) hard164.308(a)(5)(ii)(B)Protection from Malicious Software (Addressable) moderate164.308(a)(5)(ii)(C)Log-in Monitoring (Addressable) easy164.308(a)(5)(ii)(D)Password Management (Addressable) easy164.308(a)(6)(i)Security Incident Procedures (Standard) hard164.308(a)(6)(ii)Response and Reporting (Required) moderate164.308(a)(7)(i)Contingency Plan (Standard) hard164.308(a)(7)(ii)(A)Data Backup Plan (Required) moderate164.308(a)(7)(ii)(B)Disaster Recovery Plan (Required) hard164.308(a)(7)(ii)(C)Emergency Mode Operation Plan (Required) moderate164.308(a)(7)(ii)(D)Testing and Revision Procedures (Addressable) hard164.308(a)(7)(ii)(E)Applications and Data Criticality Analysis (Addressable) hard164.308(a)(8)Evaluation (Standard) hard164.308(b)(1)Business Associate Contracts and Other Arrangements (Standard) moderate164.308(b)(2)Subcontractor Arrangements hard164.308(b)(3)Written Contract or Other Arrangement hardPhysical
164.310(a)(1)Facility Access Controls (Standard) moderate164.310(a)(2)(i)Contingency Operations (Addressable) easy164.310(a)(2)(ii)Facility Security Plan (Addressable) hard164.310(a)(2)(iii)Access Control and Validation Procedures (Addressable) hard164.310(a)(2)(iv)Maintenance Records (Addressable) easy164.310(b)Workstation Use (Standard) moderate164.310(c)Workstation Security (Standard) moderate164.310(d)(1)Device and Media Controls (Standard) hard164.310(d)(2)(i)Disposal (Required) easy164.310(d)(2)(ii)Media Re-use (Required) moderate164.310(d)(2)(iii)Accountability (Addressable) moderate164.310(d)(2)(iv)Data Backup and Storage (Addressable) hardTechnical
164.312(a)(1)Access Control (Standard) moderate164.312(a)(2)(i)Unique User Identification (Required) hard164.312(a)(2)(ii)Emergency Access Procedure (Required) hard164.312(a)(2)(iii)Automatic Logoff (Addressable) moderate164.312(a)(2)(iv)Encryption and Decryption (Addressable) hard164.312(b)Audit Controls (Standard) easy164.312(c)(1)Integrity (Standard) moderate164.312(c)(2)Mechanism to Authenticate ePHI (Addressable) easy164.312(d)Person or Entity Authentication (Standard) easy164.312(e)(1)Transmission Security (Standard) easy164.312(e)(2)(i)Integrity Controls for Transmission (Addressable) easy164.312(e)(2)(ii)Encryption of Transmissions (Addressable) hardOrganizational
164.314(a)(1)Business Associate Contracts or Other Arrangements (Standard) hard164.314(a)(2)(i)Business Associate Contract Required Provisions hard164.314(a)(2)(ii)Other Arrangements (Government) hard164.314(a)(2)(iii)Business Associate Contracts with Subcontractors hard164.314(b)(1)Requirements for Group Health Plans (Standard) hard164.314(b)(2)Implementation Specifications for Group Health Plans hard