Requirement
164.308(a)(1) - Implement policies and procedures to prevent, detect, contain and correct security violations.
Implementation Specifications
Risk Analysis (Required) - 164.308(a)(1)(ii)(A)
Requirement: Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.
Risk Management (Required) - 164.308(a)(1)(ii)(B)
Requirement: Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 164.306(a).
Sanction Policy (Required) - 164.308(a)(1)(ii)(C)
Requirement: Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.
Information System Activity Review (Required) - 164.308(a)(1)(ii)(D)
Requirement: Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
Explanation
The purpose of this standard is to establish the administrative processes and procedures that a covered entity will use to implement the security program in its environment.
