[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 31)

[Assistant]
According to hitech_omnibus_2013:

ituation will determine whether reputational harm has occurred, such as whether the unlawful disclosure resulted in adverse effects on employment, standing in the community, or personal relationships.
With respect to requests to consider

18:57 Jan 24, 2013

PO 00000

Frm 00021

''other'' harm or whether unauthorized access has occurred, we reiterate that, in determining the nature and extent of the harm involved, we may consider all relevant factors, not just those expressly included in the text of the regulation. Regarding the shift in terminology from ''history of violations'' to ''prior indications of noncompliance,'' we note that use of the terms ''violation'' or ''violate'' generally indicates that the Department has made a formal finding of a violation through a notice of proposed determination. Because the Department has a number of enforcement tools, such as informal resolution through a corrective action plan, the number of ''violations'' incurred by a covered entity or business associate does not constitute an accurate picture of a covered entity's or business associate's general history of compliance with all HIPAA Rules, which is relevant in determining the amount of a civil money penalty within the penalty range. See 71 FR 8390, 8408. As such, the Department modified the provision to reflect the Department's policy of considering the covered entity's or business associate's general history of compliance with the HIPAA Rules when determining a civil money penalty. With regard to the phrase ''indications of noncompliance,'' we first clarify that a mere complaint does not constitute an indication of noncompliance. Instead, prior indications of noncompliance may refer to the number of times the Department has investigated an entity in the past and discovered indications of noncompliance that the Department resolved by informal means, such as satisfactory corrective action voluntarily taken by the covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] When must a HIPAA breach be reported to HHS?

[Assistant]
According to fda_premarket_2023:

## Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

## Guidance for Industry and Food and Drug Administration Staff

Document issued on June 27, 2025. A draft select update to this document was issued on March 13, 2024. This document supersedes 'Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,' issued September 27, 2023. For questions about this document regarding CDRH-regulated devices, contact CyberMed@fda.hhs.gov. For questions about this document regarding CBER-regulated devices, contact the Office of Communication, Outreach, and Development (OCOD) at 1-800-835-4709 or 240-402-8010, or by email at industry.biologics@fda.hhs.gov. <!-- image -->

U.S. Department of Health and Human Services Food and Drug Administration Center for Devices and Radiological Health Center for Biologics Evaluation and Research

## Public Comment

You may submit electronic comments and suggestions at any time for Agency consideration to https://www.regulations.gov. Submit written comments to the Dockets Management Staff, Food and Drug Administration, 5630 Fishers Lane, Room 1061, (HFA-305), Rockville, MD 20852. Identify all comments with the docket number FDA-2021-D-1158. Comments may not be acted upon by the Agency until the document is next revised or updated. ## Additional Copies

## CDRH

Additional copies are available from the Internet. You may also send an email request to CDRH-Guidance@fda.hhs.gov to receive a copy of the guidance. Please include the document number GUI00001825 and complete title of the guidance in the request.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 302)

[Assistant]
According to privacy_rule_2000:

Jkt 194001

PO 00000

Frm 00200

of the authorization. For example, a valid authorization could expire upon the individual's disenrollment from a health plan or upon termination of a research project.
We prohibit an authorization from having an indeterminate expiration date. These changes were intended to address situations in which a specific date for the termination of the purpose for the authorization is difficult to determine. An example may be a research study where it may be difficult to predetermine the length of the project. Comment: A few commenters requested that the named insured be permitted to sign an authorization on behalf of dependents. Response: We disagree with the commenter that a named insured should always be able to authorize uses and disclosures for other individuals in the family. Many dependents under group health plans have their own rights under this rule, and we do not assume that one member of a family has the authority to authorize uses or disclosures of the protected health information of other family members. A named insured may sign a valid authorization for an individual if the named insured is a personal representative for the individual in accordance with § 164.502(g). The determination of whether an individual is a personal representative under this rule is based on other applicable law that determines when a person can act on behalf of an individual in making decisions related to health care. This rule limits a person's rights and authorities as a personal representative to only the protected health information relevant to the matter for which he or she is a personal representative under other law. For example, a parent may be a personal representative of a child for most health care treatment and payment decisions under state law. In that case, a parent, who is a named insured for her minor child, would be able to provide authorization with respect to most protected health information about her dependent child.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 187)

[Assistant]
According to privacy_rule_2000:

mmon for new federal requirements to necessitate an examination by the regulated entities of the interaction between existing state law and the federal requirements incident to coming into compliance.
We agree, however, that the case is different where the Secretary has affirmatively acted, either through granting an exception under section 1178(a)(2)(A) or by making a specific determination about the effect of a particular state privacy law in, for example, the course of determining an entity's compliance with the privacy standards. As is discussed below, the Department intends to make notice of exception determinations that it makes routinely available. We do not agree with the comments suggesting that compliance by covered entities be delayed pending completion of an analysis by the Secretary and that states be required to certify agreement with the Secretary's analysis, as we are not institutionalizing the advisory opinion/analysis process upon which these comments are predicated. Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

Furthermore, with respect to the suggestion regarding delaying the compliance date, Congress provided in section 1175(b) of the Act for a delay in when compliance is required to accommodate the needs of covered entities to address implementation issues such as those raised by these comments. With respect to the suggestion regarding requiring states to certify their agreement with the Secretary's analysis, we have no authority to do this. Comment: Several commenters criticized the proposed provision for annual publication of determinations and advisory opinions in the Federal Register as inadequate. They suggested that more frequent notices should be made and the regulation be changed accordingly, to provide for publication either quarterly or within a few days of a determination.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 213)

[Assistant]
According to privacy_rule_2000:

ts whenever possible, which includes allowing covered entities a reasonable amount of time to work with the Secretary to come into compliance before initiating action to seek civil monetary penalties.
Section 160.306(b)(3)-Requiring That Complaints Be Filed With the Secretary Within a Certain Period of Time

Comment: A number of commenters, primarily privacy and disability advocacy organizations, suggested that

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

the regulation require that complaints be filed with the Secretary by a certain time. These commenters generally recommended that the time period for filing a complaint should commence to run from the time when the individual knew or had reason to know of the violation or omission. Another comment suggested that a requirement to file a complaint with the Secretary within 180 days of the alleged noncompliance is a problem because a patient may, because of his or her medical condition, be unable to access his or her records within that time frame. Response: We agree with the commenters that complainants should generally be required to submit complaints in a timely fashion. Federal regulations implementing Title VI of the Civil Rights Act of 1964 provide that ''[a] complaint must be filed not later than '180 days from the date of the alleged discrimination' unless the time for filing is extended by the responsible Department official or his designee.'' 45 CFR 80.7(b). Other civil rights laws, such as the Age Discrimination Act, section 504 of the Rehabilitation Act, and Title II of the Americans with Disabilities Act (ADA) (state and local government services), also use this approach. Under civil rights laws administered by the EEOC, individuals have 180 days of the alleged discriminatory act to file a charge with EEOC (or 300 days if there is a state or local fair employment practices agency involved).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 71)

[Assistant]
According to privacy_rule_2000:

n. Most group health plans are also regulated under the Employee Retirement Income Security Act of 1974 (ERISA). Under ERISA, a group health plan must be a separate legal entity from its plan sponsor.
ERISA-covered group health plans usually do not have a corporate presence, in other words, they may not have their own employees and sometimes do not have their own assets ( i.e., they may be fully insured or the benefits may be funded through the general assets of the plan sponsor, rather than through a trust). Often, the only tangible evidence of the existence of a group health plan is the contractual agreement that describes the rights and responsibilities of covered participants, including the benefits that are offered and the eligible recipients. ERISA requires the group health plan to identify a ''named fiduciary,'' a person responsible for ensuring that the plan is operated and administered properly and with ultimate legal responsibility for the plan. If the plan documents under which the group health plan was established and is maintained permit, the named fiduciary may delegate certain responsibilities to trustees and may hire advisors to assist it in carrying out its functions. While generally the named fiduciary is an individual, it may be another entity. The plan sponsor or employees of the plan sponsor are often the named fiduciaries. These structural and operational relationships present a problem in our ability to protect health information from being used inappropriately in employment-related decisions. On the one hand, the group health plan, and any health insurance issuer or HMO providing health insurance or health coverage to the group health plan, are covered entities under the regulation and may only disclose protected health information as authorized under the

Frm 00047

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

regulation or with individual consent.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 228)

[Assistant]
According to privacy_rule_2000:

nformation created or received by a researcher. They reasoned that it is important to ensure that researchers using personally identifiable health information are subject to federal privacy standards.
They also stated that if information created by a school regarding the health status of its students could be labeled ''health information,'' then information compiled by a clinical researcher regarding an individual also should be considered health information. Response: We are restricted to the statutory limits of the terms. The Congress did not include information created or received by a researcher in either definition, and, consequently, we do not include such language in the rule's definitions. Comment: Several commenters suggested modifying the definition of individually identifiable health information to state as a condition that the information provide a direct means of identifying the individual. They commented that the rule should support the need of those ( e.g., researchers) who need ''ready access to health information * * * that remains linkable to specific individuals.''

Response: The Congress included in the statutory definition of individually identifiable health information the modifier ''reasonable basis'' when describing the condition for determining whether information can be used to identify the individual. Congress thus intended to go beyond ''direct'' identification and to encompass circumstances in which a reasonable likelihood of identification exists. Even after removing ''direct'' or ''obvious'' identifiers of information, a risk or probability of identification of the subject of the information may remain; in some instances, the risk will not be inconsequential. Thus, we agree with the Congress that ''reasonable basis'' is the appropriate standard to adequately protect the privacy of individuals' health information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 32)

[Assistant]
According to security_rule_2003:

or example, ''Partition rulebased access controls,'' and the development of new access control technology. Response: We agree with the commenters that other types of access controls should be allowed.
There was no intent to limit the implementation features to the named technologies and this final rule has been reworded to make it clear that use of any appropriate access control mechanism is allowed. Proposed implementation features titled ''Context-based access,'' ''Role-based access,'' and ''User-based access'' have been deleted and the access control standard at § 164.312(a)(1) states the general requirement. b. Comment: A large number of comments were received objecting to the identification of ''Automatic logoff'' as a mandatory implementation feature. Generally the comments asked that we not be so specific and allow other forms of inactivity lockout, and that this type

VerDate Jan<31>2003

of feature be made optional, based more on the particular configuration in use and a risk assessment/analysis. Response: We agree with the comments that mandating an automatic logoff is too specific. This final rule has been written to clarify that the proposed implementation feature of automatic logoff now appears as an addressable access control implementation specification and also permits the use of an equivalent measure. c. Comment: We received comments asking that encryption be deleted as an implementation feature and stating that encryption is not required for ''data at rest.''

Response: The use of file encryption is an acceptable method of denying access to information in that file. Encryption provides confidentiality, which is a form of control. The use of encryption, for the purpose of access control of data at rest, should be based upon an entity's risk analysis. Therefore, encryption has been adopted as an addressable implementation specification in this final rule. d.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 23)

[Assistant]
According to hitech_omnibus_2013:

ll impose a civil money penalty upon a covered entity if the Secretary determines that the covered entity violated an

18:57 Jan 24, 2013

PO 00000

Frm 00016

administrative simplification provision.
Section 164.402, in paragraphs (b) and (c), provides the basis for a civil money penalty against a covered entity where more than one covered entity is responsible for a violation, where an affiliated covered entity is responsible for a violation, and where an agent of a covered entity is responsible for a violation. The proposed rule proposed to remove the exception at § 160.402(c) for covered entity liability for the acts of its agent in cases where the agent is a business associate, the relevant contract requirements have been met, the covered entity did not know of a pattern or practice of the business associate in violation of the contract, and the covered entity did not fail to act as required by the Privacy or Security Rule with respect to such violations. The proposed rule also proposed to add a parallel provision in a new paragraph (2) at § 160.402(c) that would provide for civil money penalty liability against a business associate for the acts of its agent. The existing language of §160.402(c) regarding the liability of covered entities for the acts of their agents would be re-designated as paragraph (1). These proposed changes would make covered entities and business associates liable under § 160.402(c) for the acts of their business associate agents, in accordance with the Federal common law of agency, regardless of whether the covered entity has a compliant business associate agreement in place.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] How should organizations implement administrative controls?

[Assistant]
According to nist_sp800-66r2:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-66r2

## Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

A Cybersecurity Resource Guide

Jeffrey A. Marron Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-66r2

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 179)

[Assistant]
According to privacy_rule_2000:

hus, the WIC program is not a health plan for purposes of this rule. The program of health care services for individuals detained by the INS provides health care directly, and so is not a health plan.
Similarly, the family planning program authorized by Title X of the Public Health Service Act pays for care exclusively through grants, and so is not a health plan under this rule. These programs (the grantees under the Title X program) may be or include health care

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00118

providers and may be covered entities if they conduct standard transactions. We further clarify that, where a public program meets the definition of ''health plan,'' the government agency that administers the program is the covered entity. Where two agencies administer a program jointly, they are both a health plan. For example, both the Health Care Financing Administration and the insurers that offers a Medicare+Choice plan are ''health plans'' with respect to Medicare beneficiaries. An agency that does not administer a program but which provides services for such a program is not a covered entity by virtue of providing such services. Whether an agency providing services is a business associate of the covered entity depends on whether its functions for the covered entity meet the definition of business associate in § 164.501 and, in the example described by this comment, in particular on whether the arrangement falls into the exception in §164.504(e)(1)(ii)(C) for government agencies that collect eligibility or enrollment information for covered government programs. Comment: Some commenters expressed support for retaining the category in paragraph (16) of the proposal's definition: ''Any other individual or group health plan, or combination thereof, that provides or pays for the cost of medical care.'' Others asked that the Secretary clarify this category.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 433)

[Assistant]
According to privacy_rule_2000:

g complaints, for at least six years from the date of creation. Comments: Some commenters objected to the need for covered entities to have at least one employee, if not more, to deal with complaints.
They felt that this would be costly and is redundant in light of the designation of a contact person to receive complaints. Response: We do not require assignment of dedicated staff to handle complaints. The covered entity can determine staffing based on its needs and business practices. We believe that consumers need one clear point of contact for complaints, in order that this provision effectively inform consumers how to lodge complaints and so that the compliant will get to someone who knows how to respond. The contact person (or office) is for receipt of complaints, but need not handle the complaints. ## Section 164.530(e)-Sanctions

Comment: Commenters argued that most covered entities already have strict sanctions in place for violations of a patient's privacy, either due to current laws, contractual obligations, or good operating practices. Requiring covered entities to create a formal sanctioning process would be superfluous. Response: We believe it is important for the covered entity to have these sanction policies and procedures documented so that employees are aware of what actions are prohibited and punishable. For entities that already have sanctions policies in place, it should not be problematic to document those policies. We do not define the particular sanctions that covered entities must impose. Comment: Several commenters agreed that training should be provided and expectations should be clear so that individuals are not sanctioned for doing things that they did not know were wrong or inappropriate. A good faith exception should be included in the final rule to protect these individuals. Response: We agree that employees should be trained to understand the covered entity's expectations and understand the consequences of any violation.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 2)

[Assistant]
According to privacy_mod_2002:

e frequently than once every 12 months. However, modifications are permitted during the first year after adoption of the standards if the changes are necessary to permit compliance with the standards.
HIPAA also provides that compliance with modifications to standards or implementation specifications must be accomplished by a date designated by the Secretary, which may not be earlier than 180 days after the adoption of the modification. ## B. Regulatory and Other Actions to Date

HHS published a proposed Rule setting forth privacy standards for individually identifiable health information on November 3, 1999 (64 FR 59918). The Department received more than 52,000 public comments in response to the proposal. After reviewing and considering the public comments, HHS issued a final Rule (65 FR 82462) on December 28, 2000, establishing ''Standards for Privacy of Individually Identifiable Health Information'' (''Privacy Rule''). In an era where consumers are increasingly concerned about the privacy of their personal information, the Privacy Rule creates, for the first time, a floor of national protections for the privacy of their most sensitive information-health information. Congress has passed other laws to protect consumers' personal information contained in bank, credit card, other financial records, and even video rentals. These health privacy protections are intended to provide consumers with similar assurances that their health information, including genetic information, will be properly protected. Under the Privacy Rule, health plans, health care clearinghouses, and certain health care providers must guard against misuse of individuals' identifiable health information and limit the sharing of such information, and consumers are afforded significant new rights to enable them to understand and control how their health information is used and disclosed.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 314)

[Assistant]
According to privacy_rule_2000:

ity to comply with its existing legal obligations. Comment: A number of commenters recommended that the rule compel covered entities to use or disclose protected health information as required by law.
They expressed concern that covered entities could refuse or delay compliance with legally mandated disclosures by misplaced reliance on a rule that permits, but does not require, a use or disclosure required by other law. Response: We do not agree that the final rule should require covered entities to comply with uses or disclosures of protected health information mandated by law. The

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

purpose of this rule is to protect privacy, and to allow those disclosures consistent with sound public policy. Consistent with this purpose, we mandate disclosure only to the individual who is the subject of the information, and for purposes of enforcing the rule. Where a law imposes a legal duty on the covered entity to use or disclose protected health information, it is sufficient that the privacy rule permit the covered entity to comply with such law. The enforcement of that legal duty, however, is a matter for that other law. ## Section 164.512(b)-Uses and Disclosures for Public Health Activities

Comment: Several non-profit entities commented that medical records research by nonprofit entities to ensure public health goals, such as diseasespecific registries, would not have been covered by this provision. These organizations collect information without relying on a government agency or law. Commenters asserted that such activities are essential and must continue. They generally supported the provisions allowing the collection of individually identifiable health information without authorization for registries. One stated that both governmental and non-governmental cancer registries should be exempt from the regulation.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 100)

[Assistant]
According to hitech_omnibus_2013:

that the final rule make it the priority of the business associate to inform the provider that they are acting as the business associate of the health plan to ensure provider compliance with the rule.
Other comments misconstrued the preamble statements on this issue and commented that a provider should be allowed to provide restricted protected health information to its own business associates. Response: A provider that is prohibited from disclosing protected health information to a health plan may not disclose such information to the health plan's business associate. We do not include a requirement that the business associate inform the provider that they are acting as a business associate of the health plan as it is the provider's responsibility to know to whom and for what purposes it is making a disclosure. We also clarify that a provider is not prohibited from disclosing protected health information restricted from a health plan to its own business associates for the provider's own purposes. Comment: One commenter expressed concern about the number of workforce members who must know about the restriction and indicated that this may create a risk for potential error with regard to the information. Response: Covered entities must identify those workforce members or class of persons who need access to particular protected health information, and appropriately train their workforce members as necessary to comply with these new requirements. Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with

10. Section 164.524-Access of Individuals to Protected Health Information

## Proposed Rule

Section 164.524 of the Privacy Rule currently establishes, with limited exceptions, an enforceable means by which individuals have a right to review or obtain copies of their protected health information to the extent such information is maintained in the designated record set(s) of a covered entity.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 44)

[Assistant]
According to nist_sp800-66r2:

during evaluation. | • Has the organization documented policies and procedures for conducting the evaluation of security controls? • Have management, operational, and technical issues been considered?
• Do the elements of each evaluation procedure (e.g., questions, statements, or other components) address individual, measurable security safeguards for ePHI? • Has the organization developed evaluation procedures that capture any desired metrics or measurements? |

78 See Sec. 5.2.1, HIPAA Standard: Facility Access Controls , and Sec. 5.3.1, HIPAA Standard: Access Control. 79  Organizations may wish to review and employ, where reasonable and appropriate, security control assessment procedures found in NIST [SP 800-53A], Rev.5, Assessing Security and Privacy Controls in Information Systems and Organizations . 80 See Sec. 5.5.1, HIPAA Standard: Policies and Procedures.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 340)

[Assistant]
According to privacy_rule_2000:

alance between protecting victims and providing law enforcement access to information about potential crimes that cause harm to individuals, by waiving the requirement for agreement in two situations.
In allowing covered entities to disclose protected health information about a crime victim pursuant to a state or other mandatory reporting law, we defer to other governmental bodies' judgments on when certain public policy objectives are important enough to warrant mandatory disclosure of protected health information to law enforcement. While some mandatory reporting laws are written more broadly than others, we believe that it is neither appropriate nor practicable to distinguish in federal regulations between what we consider overly broad and sufficiently focused mandatory reporting laws. The final rule waives the requirement for agreement if the covered entity is unable to obtain the individual's agreement due to incapacity or other emergency circumstance, and (1) the law enforcement official represents that the information is needed to determine whether a violation of law by a person other than the victim has occurred and the information is not intended to be used against the victim; (2) the law enforcement official represents that immediate law enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and (3) the covered entity determines, in the exercise of professional judgment, that the disclosure is in the individual's best interests. By allowing covered entities, in the exercise of professional judgment, to determine whether such disclosures are in the individual's best interests, the final rule recognizes the importance of the provider-patient relationship.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 75)

[Assistant]
According to privacy_mod_2002:

o respond to actual issues that may arise during the implementation of these provisions and to provide the guidance necessary to address concerns of IRBs, Privacy Boards, and researchers in this area.
Comment: A few commenters requested elimination of the waiver element at § 164.512(i)(2)(ii)(A)(2) that would require the IRB or Privacy Board to determine that ''there is an adequate plan to destroy identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for their retention or such retention is required by law.'' These commenters argued that this requirement may lead to premature destruction of the data, which may hinder investigations of defective data analysis or research misconduct. Response: The waiver element at §164.512(i)(2)(ii)(A)(2) accounts for these concerns by permitting the retention of identifiers if there is a health or research justification, or if such retention is required by law. It is expected that IRBs and Privacy Boards will consider the need for continued analysis of the data, research, and possible investigations of research misconduct when considering whether this waiver element has been met. In addition, destroying identifiers at the

19:04 Aug 13, 2002

PO 00000

Frm 00050

earliest opportunity helps to ensure that the use or disclosure of protected health information will indeed pose no more than ''minimal risk to the privacy of individuals.'' Requiring the researcher to justify the need to retain patient identifiers provides needed flexibility for research, while maintaining the goal of protecting individuals' privacy interests. If additional issues arise after implementation, the Department can most appropriately address them through guidance.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] How should organizations implement physical controls?

[Assistant]
According to privacy_mod_2002:

<unknown>

## DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

## 45 CFR Parts 160 and 164

RIN 0991-AB14

## Standards for Privacy of Individually Identifiable Health Information

AGENCY: Office for Civil Rights, HHS. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (''HHS'' or ''Department'') modifies certain standards in the Rule entitled ''Standards for Privacy of Individually Identifiable Health Information'' (''Privacy Rule''). The Privacy Rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996. The purpose of these modifications is to maintain strong protections for the privacy of individually identifiable health information while clarifying certain of the Privacy Rule's provisions, addressing the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieving unintended administrative burdens created by the Privacy Rule. DATES: This final rule is effective on October 15, 2002. FOR FURTHER INFORMATION CONTACT: Felicia Farmer, 1-866-OCR-PRIV (1866-627-7748) or TTY 1-866-7884989. ## SUPPLEMENTARY INFORMATION:

Availability of copies, and electronic access. Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 (or toll-free at 1-866-5121800) or by fax to (202) 512-2250. The cost for each copy is $10.00.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 398)

[Assistant]
According to privacy_rule_2000:

d entity arranges for another person or entity to distribute the covered entity's notice on its behalf and individuals do not receive such notice, the covered entity would be in violation of the rule.
Comment: Some comments stated that covered providers without direct patient contact, such as clinical laboratories, might not have sufficient patient contact information to be able to mail the notice. They suggested we require or allow such providers to form agreements with referring providers or other entities to distribute notices on their behalf or to include their practices in the referring entity's own notice. Response: We agree with commenters' concerns about the potential administrative and financial burdens of requiring covered providers that have indirect treatment relationships with individuals, such as clinical laboratories, to distribute the notice. Therefore, we require these covered providers to provide the notice only upon request. In addition, these covered providers may elect to reach agreements with other entities distribute their notice on their behalf, or to participate in an organized health care arrangement that produces a joint notice. See §164.520(d) and the corresponding preamble discussion of joint notice requirements. Comment: Some commenters requested that covered health care providers be permitted to distribute their notice prior to an individual's initial visit so that patients could review the information in advance of the visit. They suggested that distribution in advance would reduce the amount of time covered health care providers' staff would have to spend explaining the notice to patients in the office.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 446)

[Assistant]
According to privacy_rule_2000:

accurate estimate of the costs likely to be borne as a result of the final regulation. Comment: One commenter estimated that simply training an employee could have a burdensome impact on his company.
He argued, for example, a 10hour annual requirement takes 0.5% of an employee's time if they work a 2000hour year, but factoring in sick and vacation leave, the effects of industry turnover could significantly increase the effect. Response: In the analysis below, the Department has factored in turnover rates, employment growth and greater utilization based on data obtained from broad-based surveys and a public comment. Comment: Some commenters felt that the regulatory training provisions are overly burdensome. Specific concerns centered around the requirement to train all individuals who may come in contact with protected health information and the requirement to have such individuals sign a new certifying statement at least every three years. Some commenters felt that the content of the training program should be left to the discretion of the covered entity. Response: Changes and clarifications in the training requirements are made in the final regulation, explained below. For example, the certification requirement has been eliminated. As in the NPRM, the content of the training program is left to the discretion of the covered entity. These changes are expected to lessen the training burden and are reflected in the final cost estimates. ## Compliance and Enforcement

Comment: A Member of Congress and a number of privacy and consumer groups expressed their concern with whether the Office for Civil Rights (OCR) in HHS has adequate funding to carry out the major responsibility of enforcing the complaint process established by this rule. The Member stated that ''[d]ue to the limited enforcement ability allowed for in this rule by HIPAA, it is essential that OCR have the capacity to enforce the regulations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 22)

[Assistant]
According to privacy_rule_2000:

joint enterprise involving the covered entity. The change clarifies that in either instance the person performing the function or activity (or providing the specified service) is a business associate.
We also add language to the final rule that clarifies that the mere fact that two covered entities participate in an organized health care arrangement does not make either of the covered entities a business associate of the other covered entity. The fact that the entities participate in joint health care operations or other joint activities, or pursue common goals through a joint activity, does not mean that one party is performing a function or activity on behalf of the other party (or is providing a specified services to or for the other party). In general under this provision, actions relating to the protected health information of an individual undertaken by a business associate are considered, for the purposes of this rule, to be actions of the covered entity, although the covered entity is subject to sanctions under this rule only if it has knowledge of the wrongful activity and fails to take the required actions to address the wrongdoing. For example, if a business associate maintains the medical records or manages the claims system of a covered entity, the covered entity is considered to have protected health information and the covered entity must ensure that individuals who are the subject of the information can have access to it pursuant to § 164.524. The business associate relationship does not describe all relationships between covered entities and other persons or organizations.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 38)

[Assistant]
According to breach_notification_2009:

ough e-mail or postal mail, the interim final rule requires the

15 Department of Labor, Occupational Employment Statistics; Healthcare Practitioner and Technical Occupations. http://www.bls.gov/oes/.
VerDate Nov<24>2008

15:01 Aug 21, 2009

Jkt 217001

PO 00000

entity to (1) publish a notice in the media (newspaper, television, or radio) containing the information contained in the mailed notice or post a notice on its Web site, and (2) set up a toll-free number. The toll-free number is to be included in the public notice and Web site. Based on the cost for publishing a public notice in the two leading newspapers, in the Washington, DC area, rates range between $2.91 and $15.23 per line. Based on these numbers, we estimate the cost of a public notice will cost between $80 and $400. Taking the mean of the range, we estimate an average price of $240 per notice. If we assume that a provider will publish two notices, the cost will be $480. Multiplying this amount by the number of breaches reported in 2008 for

Frm 00025

the 10 to 499 and 500 or more groupings (70), yields $33,600. It is conceivable that some breaches involving more than 10 but fewer than 500 individuals may require notices in several states or jurisdictions. The probability of this event occurring, however, we believe, is low and we did not attempt to estimate the costs of such an event. If a HIPAA covered entity has a Web site, we assume there will be no cost to post the notice to the Web site. The cost of setting up a toll-free phone number is a straight forward process of contacting any one of a number of service providers who offer toll-free service. In checking the internet, we found prices for toll-free service ranging from $0.027 per minute for a basic mail box arrangement to $0.07 per minute. Some require a

Fmt 4701

Sfmt 4700

E:\FR\FM\24AUR2.SGM

24AUR2

erowe on DSK5CLS3C1PROD with RULES\_2

monthly fee ranging from $10 to $15 per month.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 27)

[Assistant]
According to fda_premarket_2023:

ices must 'design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure . . .' (section 524B(b)(2) of the FD&C Act).
FDA considers related systems to include, among other things, manufacturer-controlled elements, such as other devices, software that performs 'other functions' as described in FDA's Guidance 'Multiple Function Device Products: Policy and Considerations,' software/firmware update servers, and connections to healthcare facility networks. In the design, development and maintenance of a cyber device, manufacturers should consider the cybersecurity risks of related systems to the cyber device and implement appropriate security controls to mitigate those risks. The documentation recommendations identified in this guidance and summarized in Appendix 4 should be considered and used to demonstrate reasonable assurance that the device and related systems are cybersecure as required by section 524B(b)(2) of the FD&C Act. 66  See section 524B(b)(1) of the FD&C Act. 67  See section 524B(b)(2) of the FD&C Act. 68  See section 524B(b)(1) of the FD&C Act. 69  See section 524B(b)(2) of the FD&C Act. ## Contains Nonbinding Recommendations

## 3. Software Bill of Materials (SBOM) (Section 524B(b)(3))

Section 524B(b)(3) of the FD&C Act requires manufacturers of cyber devices to provide an SBOM, including commercial, open-source, and off-the-shelf software components. To assist with complying with this requirement, we recommend that a cyber device provide SBOMs that contain the information recommended in Section V.A.4.b. ## D. Modifications

As previously stated, the requirements under section 524B of the FD&C Act apply to a manufacturer who submits an application or submission under any of the following pathways510(k), PMA, PDP, De Novo or HDE-for a device that meets the definition of a cyber device.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 74)

[Assistant]
According to nist_sp800-66r2:

| Health Information Technology for Economic and Clinical Health (HITECH Act), title XIII of division A and title IV of division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L.
111-5, https://www.congress.gov/bill/111th-congress/house-bill/1/text                                                                                |
| [OMNIBUS]  | 'Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule,' Volume 78, Issue 17 (January 25, 2013), https://www.govinfo.gov/content/pkg/FR-2013-01-25/pdf/2013- 01073.pdf |
| [Sec_3542] | 'Definitions,' Title 44 U.S. Code, Sec. 3542. 2011 ed. https://www.govinfo.gov/app/details/USCODE-2011-title44/USCODE-2011- title44-chap35-subchapIII-sec3542                                                                                |
| [Sec_Rule] | 45 CFR Part 160 and Part 164 Subparts A and C. Originally published as: 'Health Insurance Reform: Security Standards,' Volume 68, Issue 34, 8333 (February 20, 2003), https://www.govinfo.gov/app/details/FR-2003-02-20/03-3877. |

## Appendix A. List of Symbols, Abbreviations, and Acronyms

Selected acronyms and abbreviations used in this paper are defined below.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 9)

[Assistant]
According to fda_premarket_2023:

ty outputs of activities that are part and parcel of QS regulation compliance, and explain how the QS regulation can be leveraged to demonstrate these performance outputs. 17  See 21 CFR 820.30. ## B.
Designing for Security

When reviewing premarket submissions, FDA intends to assess device cybersecurity based on a number of factors, including, but not limited to, the device's ability to provide and implement the security objectives below throughout the device architecture. The security objectives below generally may apply broadly to devices within the scope of this guidance, including, but not limited to, devices containing artificial intelligence (AI) and cloud-based services. ## Security Objectives:

- Authenticity, which includes integrity;
- Authorization;
- Availability;
- Confidentiality; and
- Secure and timely updatability and patchability. Premarket submissions should include information that describes how the above security objectives are addressed by and integrated into the device design. The extent to which security requirements, architecture, supply chain, and implementation are needed to meet these objectives will depend on but may not be limited to:

- The device's intended use, indications for use, and reasonably foreseeable misuse;
- The presence and functionality of its electronic data interfaces;
- Its intended and actual environment of use; 18
- The risks presented by cybersecurity vulnerabilities;
- The exploitability of the vulnerabilities; and
- The risk of patient harm due to vulnerability exploitation. SPDF processes aim to reduce the number and severity of vulnerabilities and thereby reduce the exploitability of a medical device system and the associated risk of patient harm. Because exploitation of known vulnerabilities or weak cybersecurity controls should be considered reasonably foreseeable failure modes for medical device systems, these factors should be addressed in the device design.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 34)

[Assistant]
According to fda_premarket_2023:

lop and test the original product to ensure updates and patches may be applied safely and in a timely manner. - Maintain necessary third-party licenses throughout the supported lifespan of the device.
Develop contingency plans for the possibility that a third-party company goes out of business or stops supporting a licensed product. Modular designs should be considered such that third-party solutions could be readily replaced. - Implement a secure process and mechanism for providing validated software updates and patches for users. ## Appendix 2. Submission Documentation for Security Architecture Flows

In premarket submissions, FDA recommends that manufacturers provide detailed information for the views identified in Section V.B.2. Methods for providing the views and the recommendations for the level of detail to provide are discussed in the sections below. In addition to diagrams and explanatory text, call-flow views can be provided to convey some of the information details expected to be addressed in the architecture views. ## A. Diagrams

FDA recommends that manufacturers provide diagrams to help describe the medical device system architecture, interfaces, communication protocols, threats, and cybersecurity controls used throughout the system. Different diagramming methods can be used to describe the architecture, including data flow diagrams, state diagrams, swim-lane diagrams, and call-flow diagrams, among others. Architecture views should include diagram(s) with explanatory text that describes the sequence of process or protocol steps in explicit detail for an associated use case. Architecture views should provide specific protocol details of the communication pathways between parts of the medical device system, to include authentication or authorization procedures and session management techniques.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.404 require?

[Assistant]
According to breach_notification_2009:

§164.404(a)(1).

## Breaches Treated as Discovered

Section 164.404(a)(2) states that a breach shall be treated as discovered by a covered entity as of the first day the breach is known to the covered entity, or by exercising reasonable diligence would have been known to the covered entity. Thus, a covered entity is not liable for failing to provide notification in cases in which it is not aware of a breach unless the covered entity would have been aware of the breach had it exercised reasonable diligence. Section 164.404(a)(2) further provides that a covered entity is deemed to have knowledge


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does security_rule_2003 say about HIPAA compliance? (Part 47)

[Assistant]
According to security_rule_2003:

e made the following changes to the provisions of the August 12, 1998 proposed rule. Specifically, we have-

- Removed information throughout the document pertaining to electronic signature standards.
Electronic signature standards will be published in a separate final rule. - Changed the CFR part from 142 to 164. - Replaced the word ''requirement,'' when referring to a standard, with ''standard.'' Replaced ''Implementation feature'' with ''Implementation specification.''
- Modified numerous implementation features so that they are now addressable rather than mandatory. - Made minor modifications to the text throughout the document for purposes of clarity. - Removed the word ''formal'' when referring to documentation. - •
- Revised the phrase ''health information pertaining to an individual'' to ''electronic protected health information.''
- Added the following definitions to §160.103: ''Disclosure,'' ''Electronic protected health information,'' ''Electronic media,'' ''Organized health care arrangement,'' and ''Use.''
- Removed the following definitions from proposed § 142.103 since they are pertinent to other administrative simplification regulations and are defined elsewhere: code set, health care clearinghouse, health care provider, health information, health plan, medical care, small health plan, standard, and transaction. - Removed proposed §142.101 as this information is conveyed in § 160.101 and §160.102 of the Privacy Rule (65 FR 82798). Removed proposed §142.102 as it is redundant. - Moved the following definitions from § 164.501 to § 164.103 (proposed §142.103): '' ''Plan sponsor'' and ''Protected health information.'' Added definitions of ''Covered functions'' and ''Required by law.''
- Removed proposed §142.106, ''Effective dates of a modification to a standard or implementation specification,'' since this information is

17:54 Feb 19, 2003

PO 00000

Frm 00033

- covered in the ''Standards for Electronic Transactions'' final rule (65 FR 50312).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 77)

[Assistant]
According to nist_sp800-66r2:

st of, healthcare; or
- (B) Whose principal activity is:
- (1) The direct provision of healthcare to persons; or
- (2) The making of grants to fund the direct provision of healthcare to persons. [Sec.
Rule, §160.103]

## hybrid entity

A single legal entity:

- (1) That is a covered entity;
- (2) Whose business activities include both covered and non-covered functions; and
- (3) That designates healthcare components in accordance with paragraph § 164.105(a)(2)(iii)(D). ## implementation specification

Specific requirements or instructions for implementing a standard. [Sec. Rule, §160.103]

## individually identifiable health information (IIHI)

Information that is a subset of health information, including demographic information collected from an individual, and:

- (1) Is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and
- (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual; and
3. (i) That identifies the individual; or
4. (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual. [Sec. Rule, §160.103]

## information security

Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide-

- (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;
- (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
- (C) availability, which means ensuring timely and reliable access to and use of information. [44 U.S.C., Sec.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does breach_notification_2009 say about HIPAA compliance? (Part 17)

[Assistant]
According to breach_notification_2009:

that the notification should describe the steps the covered entity is taking to mitigate potential harm to the individual resulting from the breach and that such harm is not limited to economic loss.
Under these content requirements, for example, and depending on the

VerDate Nov<24>2008

circumstances, the notice to the individual may include recommendations that the individual contact his or her credit card company and information about how to contact the credit bureaus and obtain credit monitoring services (if credit card information was breached); information about steps the covered entity is taking to retrieve the breached information, such as filing a police report (if a suspected theft of unsecured protected health information occurred); information about steps the covered entity is taking to improve security to prevent future similar breaches; and information about sanctions the covered entity imposed on workforce members involved in the breach. Some commenters recommended that we impose a page limitation on the length of the notice (e.g., one page in length) and ensure the content of the notice is non-technical and noncomplex so individuals can easily understand the information being provided. We agree that it is important for individuals to be able to understand the information being provided to them in the breach notifications and thus, at §164.404(c)(2) of the interim final rule, include a requirement that such notifications be written in plain language. To satisfy this requirement, the covered entity should write the notice at an appropriate reading level, using clear language and syntax, and not include any extraneous material that might diminish the message it is trying to convey. We do not impose a page limitation, however, so as not to constrain covered entities in including in the notifications the information they believe could be helpful to individuals.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 38)

[Assistant]
According to privacy_rule_2000:

bject to ADA confidentiality restrictions, as well as this privacy regulation. See Carparts Distribution Center, Inc. v. Automotive Wholesaler's

Association of New England, Inc., 37 F.3d 12 (1st Cir.
1994)(setting forth three bases for ADA Title I jurisdiction over an employer-provided medical reimbursement plan, in a discrimination challenge to the plan's HIV/AIDS cap). Transmission of applicant or employee health information by the employer's management to the group health plan may be permitted under the ADA standards as the use of medical information for insurance purposes. Similarly, disclosure of such medical information by the group health plan, under the limited circumstances permitted by this privacy regulation, may involve use of the information for insurance purposes as broadly described in the ADA discussion above. Entities that receive federal financial assistance, which may also be covered entities under the privacy regulation, are subject to section 504 of the Rehabilitation Act (29 U.S.C. 794) and its implementing regulations. Each federal agency has promulgated such regulations that apply to entities that receive financial assistance from that agency (''recipients''). These regulations may limit the disclosure of medical information about persons who apply to or participate in a federal financially assisted program or activity. For example, the Department of Labor's section 504 regulation (found at 29 CFR part 32), consistent with the ADA standards, requires recipients that conduct employment-related programs, including employment training programs, to maintain confidentiality regarding any information about the medical condition or history of applicants to or participants in the program or activity. Such information must be kept separate from other information about the applicant or participant and may be provided to certain specified individuals and entities, but only under certain limited circumstances described in the regulation.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does fda_premarket_2023 say about HIPAA compliance? (Part 20)

[Assistant]
According to fda_premarket_2023:

that has only a USB interface. ## (a) Global System View

A global system view should describe the overall medical device system, including the device itself and all internal and external connections.
For interconnected and networked devices, this view should identify all interconnected elements, including any software update infrastructure(s),

## Contains Nonbinding Recommendations

healthcare facility network impacts, intermediary connections or devices, cloud connections, and patient home network impact. Depending on the complexity of the medical device system, it may not be feasible to include all data flow specifics in a singular global system view. Additional views can be provided that detail the communication specifics as recommended in Appendix 2 and do not need to be duplicated if captured in one of the other types of views detailed below. ## (b) Multi-Patient Harm View

When devices are capable of connecting (wired or wirelessly) to another medical or non-medical product, to a network, or to the Internet, there is the possibility that multiple devices can be compromised simultaneously. Because of that connectivity, if a device is compromised, or if a non-device function (i.e., any function that does not fall within section 201(h) of the FD&C Act) that could impact the device function is compromised, the device may introduce a safety risk to patients through security risk. This may change the device's functionality. For example, a nondevice function could be hacked to perform a device function and ultimately harm patients. Depending on the device risk and use environment, a multiple-device compromise may have severe impacts for multiple patients, either through impact to the device itself and/or to healthcare facility operations (e.g., multiparameter bedside monitors all restarting at once, leaving all monitors connected to the same network no longer monitoring patient vitals and staffing levels not able to monitor all patient vitals).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 66)


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_mod_2002 say about HIPAA compliance? (Part 12)

[Assistant]
According to privacy_mod_2002:

rketing. The covered entity needs the individual's authorization to use or disclose protected health information for marketing communications, regardless of whether clinical information is to be used.
Comment: The proposed modification eliminated the § 164.514 requirements that permitted the use of protected health information to market healthrelated products and services without an authorization. In response to that proposed modification, many commenters asked whether covered entities would be allowed to make communications about ''health education'' or ''health promoting'' materials or services without an authorization under the modified Rule. Examples included communications about health improvement or disease prevention, new developments in the diagnosis or treatment of disease, health fairs, health/wellness-oriented classes or support groups. Response: The Department clarifies that a communication that merely promotes health in a general manner

VerDate Aug<2,>2002

and does not promote a specific product or service from a particular provider does not meet the general definition of ''marketing.'' Such communications may include population-based activities to improve health or reduce health care costs as set forth in the definition of ''health care operations'' at § 164.501. Therefore, communications, such as mailings reminding women to get an annual mammogram, and mailings providing information about how to lower cholesterol, about new developments in health care (e.g., new diagnostic tools), about health or ''wellness'' classes, about support groups, and about health fairs are permitted, and are not considered marketing. Comment: Some commenters asked whether they could communicate with beneficiaries about government programs or government-sponsored programs such as information about SCHIP; eligibility for Medicare/Medigap (e.g., eligibility for limited, six-month open enrollment period for Medicare supplemental benefits).


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does hitech_omnibus_2013 say about HIPAA compliance? (Part 77)

[Assistant]
According to hitech_omnibus_2013:

erned by other provisions of the Privacy Rule. We decline to include language in the final rule placing the burden of proof on the requestor to demonstrate they were involved in the individual's care.
In some cases, it will be readily apparent to the covered entity that a person is a family member or was involved in the individual's care prior to death because the person would have made themselves known to the covered entity prior to the individual's death by either visiting with or inquiring about the individual, or the individual would have identified such person as being involved in their care or payment for care to a member of the covered entity's workforce. In other cases, the covered entity need just have reasonable assurance that the person is a family member of the decedent or other person who was involved in the individual's care or payment for care prior to death. For example, the person may indicate to the covered entity how he or she is related to the decedent or offer sufficient details about the decedent's circumstances prior to death to indicate involvement in the decedent's care prior to death. As stated above, a covered entity that is uncomfortable disclosing protected health information under this provision because of questions about the person's

Fmt 4701

Sfmt 4700

E:\FR\FM\25JAR2.SGM

25JAR2

Jkt 229001

sroberts on DSK5SPTVN1PROD with relationship to the decedent is not required to do so. Comment: Several commenters requested and offered suggested clarifications on the scope of the terms ''personal representative'' and ''family member.''

Response: The Privacy Rule already identifies the persons who qualify as a personal representative of a decedent at §164.502(g)(4). Further, this final rule includes a definition of ''family member'' at § 160.103.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 270)

[Assistant]
According to privacy_rule_2000:

pport services would be a business associate of the Medicaid agency, but was unclear as to whether it would also constitute a health care component within its own agency. Response: We generally agree.
We expect that in most cases, government agencies that run health plans or provide health care services would typically meet the definition of a ''hybrid entity'' under § 164.504(a), so that such an agency would be required to designate the health care component or components that run the program or programs in question under §164.504(c)(3), and the rules would not apply to the remainder of the agency's operations, under § 164.504(b). In addition, we have created an exception to the business associate contract requirement for government agencies who perform functions on behalf of other government agencies. Government agencies can enter into a memorandum of understanding with another government entity or adopt a regulation that applies to the other government entity in lieu of a business associate contract, as long as the memorandum or regulation contains certain terms. See

§164.504(e). Comment: One commenter representing an insurance company stated that different product lines should be treated separately under the rule. For example, the commenter argued, because an insurance company offers both life insurance and health insurance, it does not mean that the insurance company itself is a covered entity, rather only the health insurance component is a covered entity. Another commenter requested clarification of the use of the term ''product line'' in the proposed rule. This commenter stated that product line should differentiate between different lines of coverage such

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00179

as life vs. health insurance, not different variations of the same coverage, such as HMO vs. PPO.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 405)

[Assistant]
According to privacy_rule_2000:

are required to establish policies and procedures for providing individuals the right to request restrictions, including policies for who may agree to such restrictions on the covered entity's behalf.
Hospitals and other large entities that are concerned about employees agreeing to restrictions on behalf of the organization will have to make sure that their policies are communicated appropriately to those employees. The circumstances under which members of a covered entity's workforce can bind the covered entity are a function of other law, not of this regulation. Comment: Commenters expressed confusion about the intended effect of any agreed-upon restrictions on downstream covered entities. They asserted that it would be extremely difficult for a requested restriction to be followed through the health care system and that it would be unfair to hold covered entities to a restriction when they did not agree to such restriction. Specifically, commenters asked whether a covered provider that receives protected health information in compliance with this rule from a physician or medical group that has agreed to limit certain uses of the information must comply with the original restriction. Other commenters expressed concern that not applying a restriction to downstream covered entities is a loophole and that all downstream covered providers and health plans should be bound by the restrictions. Response: Under the final rule, a restriction that is agreed to between an individual and a covered entity is only binding on the covered entity that agreed to the restriction and not on downstream entities. It would also be binding on any business associate of the covered entity since a business associate can not use or disclose protected health information in any manner that a covered entity would not be permitted to use or disclose such information.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 243)

[Assistant]
According to privacy_rule_2000:

rule are more appropriate for protecting health information. However, we add provisions to the definition of payment which should address these concerns. See the definition of 'payment' in § 164.501.
Comment: An insurance company recommended that the rule require that medical records containing protected health information include a notation on a cover sheet on such records. Response: Since we have expanded the scope of protected health information, there is no need for covered entities to distinguish among their records, and such a notation is not needed. This uniform coverage eliminates the mixed record problem and resultant potential for confusion. Comment: A government agency requested clarification of the definition to address the status of information that flows through dictation services. Response: A covered entity may disclose protected health information for transcription of dictation under the definition of health care operations, which allows disclosure for ''general administrative'' functions. We view transcription and clerical services generally as part of a covered entity's general administrative functions. An entity transcribing dictation on behalf of a covered entity meets this rule's definition of business associate and may receive protected health information under a business associate contract with

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

Frm 00161

the covered entity and subject to the other requirements of the rule. Comment: A commenter recommended that information transmitted for employee drug testing be exempted from the definition. Response: We disagree that is necessary to specifically exclude such information from the definition of protected health information. If a covered entity is involved, triggering this rule, the employer may obtain authorization from the individuals to be tested.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 110)

[Assistant]
According to privacy_rule_2000:

rding health care fraud from the law enforcement section, because all disclosures that would have been allowed under that provision are allowed under § 164.512(d) of the final rule (health oversight).
Similarly, in the final rule, we eliminate proposed

Fmt 4701

E:\FR\FM\28DER2.SGM

pfrm08

PsN: 28DER2

Sfmt 4700

§164.510(f)(5)(iii) on disclosure of protected health information to law enforcement officials regarding criminal activity witnessed by a member of a health plan workforce. All disclosures that would have been permitted by that provision are included in §164.512(f)(5), which allows disclosure of information to report a crime committed on the covered entity's premises, and by § 164.502, which provides that a covered entity is not in violation of the rule when a member of its workforce or person working for a business associate uses or discloses protected health information while acting as a ''whistle blower.'' Thus, §164.512(f)(5) allows covered entities to disclose health information only on the good faith belief that it constitutes evidence of a crime on their premises. The preamble to the NPRM said that if the covered entity disclosed protected health information in good faith but was wrong in its belief that the information was evidence of a violation of law, the covered entity would not be subject to sanction under this regulation. The final rule retains this approach. ## Reporting Crime in Emergencies

The proposed rule did not address disclosures by emergency medical personnel to a law enforcement official intended to alert law enforcement about the commission of a crime. Because the provisions of proposed rule were limited to individually identifiable health information that was reduced to electronic form, many communications that occur between emergency medical personnel and law enforcement officials at the scene of a crime would not have been covered by the proposed provisions.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 529)

[Assistant]
According to privacy_rule_2000:

view procedure if the research involves no more than minimal risk to the privacy of the individuals who are the subject of the protected health information for which use or disclosure is being sought.
If the privacy board elects to use an expedited review procedure, the review and approval of the alteration or waiver of authorization may be carried out by the chair of the privacy board, or by one or more members of the privacy board as designated by the chair; and
- (v) Required signature. The documentation of the alteration or

VerDate 11<MAY>2000

19:16 Dec 27, 2000

- waiver of authorization must be signed by the chair or other member, as designated by the chair, of the IRB or the privacy board, as applicable. - (j) Standard: Uses and disclosures to avert a serious threat to health or safety. (1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:
- (i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and
- (B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or
- (ii) Is necessary for law enforcement authorities to identify or apprehend an individual:
- (A) Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or
- (B) Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody, as those terms are defined in § 164.501. - (2) Use or disclosure not permitted.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does §164.512(i)(2)(i) require?

[Assistant]
According to privacy_rule_2000:

§164.512(i)(2)(i) and (v).

- (ii) Identity of public officials. A covered entity may rely, if such reliance is reasonable under the circumstances, on any of the following to verify identity when the disclosure of protected health information is to a public official or a person acting on behalf of the public official:
- (A) If the request is made in person, presentation of an agency identification badge, other official credentials, or other proof of government status;
- (B) If the request is in writing, the request is on the appropriate government letterhead; or

(C) If the disclosure is to a


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 17)

[Assistant]
According to nist_sp800-66r2:

Assessment scale for overall likelihood | Likelihood | Likelihood that Threat Events Result in Adverse Impacts | Likelihood that Threat Events Result in Adverse Impacts | Likelihood that Threat Events Result in Adverse Impacts | Likelihood that Threat Events Result in Adverse Impacts | Likelihood that Threat Events Result in Adverse Impacts | |------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------| | of Threat Event Initiation or Occurrence | Very Low | Low | Moderate | High | Very High | | Very High | Low | Moderate | High | Very High | Very High | | High | Low | Moderate | Moderate | High | Very High | | Moderate | Low | Low | Moderate | Moderate | High | | Low | Very Low | Low | Low | Moderate | Moderate | | Very Low | Very Low | Very Low | Low | Low | Low | The regulated entity could perform this likelihood assessment for each threat/vulnerability pairing.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does privacy_rule_2000 say about HIPAA compliance? (Part 488)

[Assistant]
According to privacy_rule_2000:

A case law describes such activities as settlor functions. For example a plan sponsor may want to change its contract from a preferred provider organization to a health maintenance organization (HMO).
In order to obtain premium information, the health plan sponsor may need to provide the HMO with aggregate claims information. Under the rule, the health plan sponsor can obtain summary information with certain identifiers removed, in order to provide it to the HMO and receive a premium rate. The Department assumes that most health plan sponsors who are small employers (those with 50 or fewer employees) will elect not to receive individually identifiable health information because they will have

VerDate 11<MAY>2000

19:16 Dec 27, 2000

Jkt 194001

PO 00000

little, if any, need for such data. Any needs that sponsors of small group health plans may have for information can be accomplished by receiving the information in summary form from their health insurance issuers. ## 3. The Burden on a Typical Small Business

The Department expects small entities to face a cost burden as a result of complying with the proposed regulation. We estimate that the burden of developing privacy policies and procedures is lower in dollar terms for small businesses than for large businesses, but we recognize that the cost of implementing privacy provisions could be a larger burden to small entities as a proportion of total revenue. Due to these concerns, we have relied on the principle of scalability throughout the rule, and have based our cost estimates on the expectation that small entities will develop less expensive and less complex privacy measures that comply with the rule than large entities. In many cases, we have specifically considered the impact that rule may have on solo practitioners or rural health care providers. If a health care provider only maintains paper records and does not engage in any electronic transactions, the regulation would not apply to such provider.


[System] You are a HIPAA compliance expert with deep knowledge of the Security Rule, Privacy Rule, and Breach Notification Rule. You provide accurate, practical guidance on HIPAA requirements, implementation specifications, and compliance procedures. You cite specific CFR sections and distinguish between covered entity and business associate obligations.

[User] What does nist_sp800-66r2 say about HIPAA compliance? (Part 39)

[Assistant]
According to nist_sp800-66r2:

Develop and Implement Policy and Procedures to Respond to and Report Security Incidents Implementation Specification (Required) | • Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes. • Ensure that an organizational incident response policy 70 is in place that addresses all parts of the organization in which ePHI is created, stored, processed, or transmitted. • Document incident response procedures that can provide a single point of reference to guide the day-to-day operations of the incident response team. • Review incident response procedures with staff who have roles and responsibilities related to incident response; solicit suggestions for improvements; and make changes to reflect input, if reasonable and appropriate. • Consider conducting tests of the incident response plan. • Update the procedures as required based on changing organizational needs. 71 | • Has the organization determined that maintaining a staffed security incident hotline would be reasonable and appropriate? • Has the organization developed processes for documenting and tracking incidents? • Has the organization determined reasonable and appropriate mitigation options for security incidents? • Has the organization developed standardized incident report templates to record necessary information related to incidents? • Has the organization determined that information captured in the reporting templates is reasonable and appropriate to investigate an incident? • Has the organization determined the conditions under which information related to a security breach will be disclosed to the media? • Have appropriate (internal and external) persons who should be informed of a security breach been identified? Has a contact information list been prepared?