As outlined in 45 CFR § 164.316 of the Security Rule, CEs must  implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of the Security Rule.

The 18 Security Rule standards contain a total of 42 implementation specifications that are either __________ or ___________.  (Choose all that apply)

A covered entity must reasonably safeguard PHI to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

ePHI stands for: _________________________________________that is created, received, maintained, or transmitted electronically

The Privacy Rule requires __________  ____________ access to PHI. The Security Rule requires administrative, physical, and technical safeguards, all involving access based on minimum requirements as they relate to job responsibilities.

In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information.

President Bill Clinton signed the HIPAA into law, and was coded into the Code of Federal Regulations as 45 CFR Part 164: Security and Privacy Rule.

Breach notification Rule require covered entities and business assocites to notify HHS if more than 500 patient records were exposed, no later than 60 days after the incident was discovered.

Under the HIPAA Privacy Rule, a provider does not need permission from the patient to further disclose the information other than as permitted or required by the contract or as required by law

What is the definition of a Covered Entity?