164.316(a) Policies and procedures
The standard requiring reasonable and appropriate written policies and procedures for every Security Rule requirement, scaled to the entity, and allowing changes at any time if documented.
Policies, procedures and documentation
The two standards in 45 CFR 164.316: written policies and procedures for every Security Rule requirement, and documentation with its three required specifications on six-year retention, availability and updates.
164.316(b)(1) Documentation
The standard requiring written (electronic is fine) policies and procedures plus records of every action, activity or assessment the rule says to document. Parent of three required specifications: time limit, availability and updates.
164.316(b)(2)(i) Time limit
The required six-year retention period for Security Rule documentation, counted from creation or from the date it was last in effect, whichever is later.
164.316(b)(2)(ii) Availability
The required step of making Security Rule documentation available to the people responsible for carrying out the procedures it describes.
164.316(b)(2)(iii) Updates
The required periodic review and update of Security Rule documentation in response to environmental or operational changes affecting ePHI security, tied to the maintenance duty in 164.306(e).
