Security Personnel
A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.
Information Access Management
A covered entity must implement policies and procedures for authorizing access to e-PHI, only when such access is appropriate based on the user or recipient’s role.
Facility Access and Control
A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.
Workstation & Device Security
A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.
Workforce Training & Management
A covered entity must provide for appropriate authorization and supervision of workforce members who work with e-PHI. A covered entity must train all workforce members regarding its security policies and procedures, and must have and apply appropriate sanctions against workforce members who violate its policies and procedures.
Transmission Security
A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.
