164.306 Security Standards: General Rules
Administrative safeguard · Provision
The requirement as we hold it
Security Standards: General Rules. Covered entities and business associates must ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) they create, receive, maintain, or transmit; protect against reasonably anticipated threats; protect against reasonably anticipated impermissible uses or disclosures; and ensure workforce compliance. Entities may use flexibility of approach considering size, complexity, capabilities, technical infrastructure, costs, and probability and criticality of risks to ePHI.
The examiner asks
- Walk me through how you decide what is reasonable and appropriate for an entity of your size and risk profile, and show where that decision is recorded.
- Show the analysis that weighs the probability and criticality of each risk to ePHI against your capabilities and cost.
Evidence to bring
- the flexibility-of-approach rationale
- the risk-to-capability mapping
Source: 164.306 at eCFR. Our statement of the clause, not the instrument verbatim.