HIPAA 45 C.F.R. § Business covered entity, in accordance with “A 164.308(b)(1) Associate [45 C.F.R. § 164.306], may permit a Contracts business associate to create, receive, maintain, or transmit [ePHI] on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with [45 C.F.R. § 164.314(a) that the business associate will appropriately safeguard the information” HIPAA 45 C.F.R. § Physical 164.310 Safeguards HIPAA 45 C.F.R. § Facility Access policies and procedures to “Implement 164.310(a)(1) Controls physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.” HIPAA 45 C.F.R. § Contingency (and implement as needed) “Establish 164.310(a)(2)(i) Operations procedures that allow facility access in (Addressable) support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.” 45 C.F.R. § Facility Security policies and procedures to “Implement 164.310(a)(2)(ii) Plan safeguard the facility and the equipment (Addressable) therein from unauthorized physical access, tampering, and theft.”
HIPAA 45 C.F.R. § 164.308(b)(1) Business Associate Contracts “A covered entity, in accordance with [45 C.F.R. § 164.306], may permit a business associate to create, receive, maintain, or transmit [ePHI] on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with [45 C.F.R. § 164.314(a) that the business associate will appropriately safeguard the information” HIPAA 45 C.F.R. § 164.310 Physical Safeguards HIPAA 45 C.F.R. § 164.310(a)(1) Facility Access Controls “Implement policies and procedures to physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.” HIPAA 45 C.F.R. § 164.310(a)(2)(i) Contingency Operations (Addressable) “Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.” 45 C.F.R. § 164.310(a)(2)(ii) Facility Security Plan (Addressable) “Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.”
CITL-HITECH-HIPAA-Gap-Analysis.docx