164.308(a)(4)(ii)(A) Isolating Health Care Clearinghouse Functions (Required if applicable)
Administrative safeguard · Required if applicable
The requirement as we hold it
Isolating Health Care Clearinghouse Functions (Required if applicable). If a clearinghouse is part of a larger organization, isolate ePHI from the larger organization. NIST recommends network segmentation and separate access domains.
The examiner asks
- If a clearinghouse function sits inside a larger organisation, show me how the ePHI is isolated.
- Where is the network or access separation documented?
Evidence to bring
- the isolation design
- the separation evidence
Source: 164.308(a)(4)(ii)(A) at eCFR. Our statement of the clause, not the instrument verbatim.