{"data":{"id":"us/45-cfr-164.318","jurisdiction":"us","citation":"45 CFR 164.318","heading":"Compliance dates for the initial implementation of the security standards.","body":"(a) Health plan. (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.\n(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.\n(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.\n(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.","path":["Title 45—Public Welfare","SUBTITLE A—Department of Health and Human Services","SUBCHAPTER C—ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS","PART 164—SECURITY AND PRIVACY","Subpart C—Security Standards for the Protection of Electronic Protected Health Information"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-45.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:26:21Z","sha256":"c25ddd4f60dbf22fd80b7a13c92456c0e7538b9fe56d0b060360f3bca1167efd","source_id":"us-cfr","stale":true,"prev":"us/45-cfr-164.316","next":"us/45-cfr-appendix-a-to-subpart-c-of-part-164"},"notice":"GroundRules: Original legal text. Not legal advice."}