164.308(a)(6)(ii) Response and Reporting (Required)
Administrative safeguard · Required
The requirement as we hold it
Response and Reporting (Required). Identify and respond to suspected or known incidents, mitigate harmful effects, and document incidents and their outcomes. NIST recommends linkage to HIPAA Breach Notification Rule timelines.
The examiner asks
- Show me how you identify and respond to a suspected incident, and how you document its outcome.
- Where does that record link to the breach notification decision?
Evidence to bring
- an incident record
- the incident-to-notification linkage
Source: 164.308(a)(6)(ii) at eCFR. Our statement of the clause, not the instrument verbatim.