Requirement
164.316(b)(1) - (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) if an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.
Implementation Specifications
Time Limit (Required) - 164.316(b)(2)(i)
Requirement: Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
Availability (Required) - 164.316(b)(2)(ii)
Requirement: Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.
Updates (Required) - 164.316(b)(2)(iii)
Requirement: Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.
