| 💼 164.308 Administrative Safeguards | 30 | 2 | 1 | | no data |
| 　💼 164.308(a)(1)(i) Security Management Process | | | | | no data |
| 　💼 164.308(a)(1)(ii)(A) Risk Analysis (R) | | | | | no data |
| 　💼 164.308(a)(1)(ii)(B) Risk Management (R) | | | | | no data |
| 　💼 164.308(a)(1)(ii)(C) Sanction Policy (R) | | | | | no data |
| 　💼 164.308(a)(1)(ii)(D) Information System Activity Review (R) | | | | | no data |
| 　💼 164.308(a)(2) Assigned Security Responsibility | | | | | no data |
| 　💼 164.308(a)(3)(i) Workforce Security (R) | | | | | no data |
| 　💼 164.308(a)(3)(ii)(A) Authorization and/or Supervision (A) | | | | | no data |
| 　💼 164.308(a)(3)(ii)(B) Workforce Clearance Procedure (A) | | | | | no data |
| 　💼 164.308(a)(3)(ii)(C) Termination Procedures (A) | | | | | no data |
| 　💼 164.308(a)(4)(i) Information Access Management (R) | | | | | no data |
| 　💼 164.308(a)(4)(ii)(A) Isolating Health Care ClearinghouseFunction (R) | | | | | no data |
| 　💼 164.308(a)(4)(ii)(B) Access Authorization (A) | | 2 | 1 | | no data |
| 　💼 164.308(a)(4)(ii)(C) Access Establishment and Modification (A) | | | | | no data |
| 　💼 164.308(a)(5)(i) Security Awareness and Training (R) | | | | | no data |
| 　💼 164.308(a)(5)(ii)(A) Security Reminders (A) | | | | | no data |
| 　💼 164.308(a)(5)(ii)(B) Protection from Malicious Software(A) | | | | | no data |
| 　💼 164.308(a)(5)(ii)(C) Log-in Monitoring (A) | | | | | no data |
| 　💼 164.308(a)(5)(ii)(D) Password Management (A) | | | | | no data |
| 　💼 164.308(a)(6)(i) Security Incident Procedures (R) | | | | | no data |
| 　💼 164.308(a)(6)(ii) Response and Reporting (R) | | | | | no data |
| 　💼 164.308(a)(7)(i) Contingency Plan (R) | | | | | no data |
| 　💼 164.308(a)(7)(ii)(A) Data Backup Plan (R) | | | | | no data |
| 　💼 164.308(a)(7)(ii)(B) Disaster Recovery Plan (R) | | | | | no data |
| 　💼 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan (R) | | | | | no data |
| 　💼 164.308(a)(7)(ii)(D) Testing and Revision Procedure (A) | | | | | no data |
| 　💼 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (A) | | | | | no data |
| 　💼 164.308(a)(8) Evaluation (R) | | | | | no data |
| 　💼 164.308(b)(1) Business Associate Contracts and Other Arrangements (R) | | | | | no data |
| 　💼 164.308(b)(4) Written Contract or Other Arrangement(R) | | | | | no data |
| 💼 164.310 Physical Safeguards | 12 | | | | no data |
| 　💼 164.310(a)(1) Facility Access Controls (R) | | | | | no data |
| 　💼 164.310(a)(2)(i) Contingency Operations (A) | | | | | no data |
| 　💼 164.310(a)(2)(ii) Facility Security Plan (A) | | | | | no data |
| 　💼 164.310(a)(2)(iii) Access Control and Validation Procedures (A) | | | | | no data |
| 　💼 164.310(a)(2)(iv) Maintenance Records (A) | | | | | no data |
| 　💼 164.310(b) Workstation Use (R) | | | | | no data |
| 　💼 164.310(c) Workstation Security (R) | | | | | no data |
| 　💼 164.310(d)(1) Device and Media Controls (R) | | | | | no data |
| 　💼 164.310(d)(2)(i) Disposal (R) | | | | | no data |
| 　💼 164.310(d)(2)(ii) Media Re-Use (R) | | | | | no data |
| 　💼 164.310(d)(2)(iii) Accountability (A) | | | | | no data |
| 　💼 164.310(d)(2)(iv) Data Backup and Storage (A) | | | | | no data |
| 💼 164.312 Technical Safeguards | 12 | 16 | 23 | | no data |
| 　💼 164.312(a)(1) Access Control (R) | | 2 | 2 | | no data |
| 　💼 164.312(a)(2)(i) Unique User Identification (R) | | | | | no data |
| 　💼 164.312(a)(2)(ii) Emergency Access Procedure (R) | | | | | no data |
| 　💼 164.312(a)(2)(iii) Automatic Logoff (A) | | | | | no data |
| 　💼 164.312(a)(2)(iv) Encryption and Decryption (A) | | 2 | 2 | | no data |
| 　💼 164.312(b) Audit Controls (R) | | 3 | 3 | | no data |
| 　💼 164.312(c)(1) Integrity (R) | | 2 | 1 | | no data |
| 　💼 164.312(c)(2) Mechanism to Authenticate ElectronicPHI (A) | | | | | no data |
| 　💼 164.312(d) Person or Entity Authentication (R) | | 2 | 2 | | no data |
| 　💼 164.312(e)(1) Transmission Security (R) | | 2 | 10 | | no data |
| 　💼 164.312(e)(2)(i) Integrity Controls (A) | | 2 | 2 | | no data |
| 　💼 164.312(e)(2)(ii) Encryption (A) | | 1 | 1 | | no data |
| 💼 164.316 Policies & Procedures and Documentation Requirements | 7 | | | | no data |
| 　💼 164.316(a) Policies and Procedures (R) | | | | | no data |
| 　💼 164.316(b)(1) Documentation (R) | | | | | no data |
| 　💼 164.316(b)(1)(i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form. (R) | | | | | no data |
| 　💼 164.316(b)(1)(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment (R) | | | | | no data |
| 　💼 164.316(b)(2)(i) Time Limit (R) | | | | | no data |
| 　💼 164.316(b)(2)(ii) Availability (R) | | | | | no data |
| 　💼 164.316(b)(2)(iii) Updates (R) | | | | | no data |