Reference:USA 45 CFR Part 160 09-Apr-2025 § 164.530
From GxPlex
| Document information | |
|---|---|
| Reference | USA 45 CFR Part 160 09-Apr-2025 |
| Validity area | USA |
| Scope(s) | G |
| Document name | 45 CFR Part 160 |
| Version / Revision | 09-Apr-2025 |
| Status | Current |
| Document type | Legal act |
| Language(s) | EN |
| Description | Title 45—Public Welfare
Subtitle A—Department of Health and Human Services Subchapter C—Administrative Data Standards and Related Requirements Part 164 Security and Privacy https://www.ecfr.gov/current/title-45 |
| Official source | Official link |
| Restricted access | No |
| Submitted by | Florian Adragna |
| Contributors | |
| Reference Details | |
|---|---|
| Scope | G |
| Document part | § 164.530 |
| Language | EN |
| Original entry by | Florian Adragna |
| Contributors | |
| Tags (EN) | |
| Tags (original language) | |
| Tags (FR) | |
| Comment | Administrative requirements for policies and procedures |
Content
§ 164.530 Administrative requirements. […] (i)
(1) Standard: Policies and procedures.
A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part. The policies and procedures must be reasonably designed, taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity, to ensure such compliance. This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of this subpart. [...] (j)
(1) Standard: Documentation. A covered entity must:
(i) Maintain the policies and procedures provided for in paragraph (i) of this section in written or electronic form;
(ii) If a communication is required by this subpart to be in writing, maintain such writing, or an electronic copy, as documentation; and
(iii) If an action, activity, or designation is required by this subpart to be documented, maintain a written or electronic record of such action, activity, or designation.
(iv) Maintain documentation sufficient to meet its burden of proof under § 164.414(b).
(2) Implementation specification: Retention period. A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later. [...]
