164.314(b)(2) Implementation Specifications for Group Health Plans
Organizational safeguard · Provision
The requirement as we hold it
Implementation Specifications for Group Health Plans. The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the ePHI; ensure that the adequate separation required by 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures; ensure that any agent to whom it provides such information agrees to implement reasonable and appropriate security measures to protect the information; and report to the group health plan any security incident of which it becomes aware.
The examiner asks
- Show me the plan-document provisions that require the sponsor to implement safeguards and support the required separation.
- Where is the incident-reporting requirement to the plan?
Evidence to bring
- the amended plan documents
- the incident-reporting clause
Source: 164.314(b)(2) at eCFR. Our statement of the clause, not the instrument verbatim.