{"data":{"id":"us/45-cfr-appendix-a-to-subpart-c-of-part-164","jurisdiction":"us","citation":"45 CFR Appendix A to Subpart C of Part 164","heading":"Appendix A to Subpart C of Part 164—Security Standards: Matrix","body":"Standards Sections Implementation Specifications (R) = Required, (A) = Addressable\nAdministrative Safeguards\nSecurity Management Process 164.308(a)(1) Risk Analysis (R)\nRisk Management (R)\nSanction Policy (R)\nInformation System Activity Review (R)\nAssigned Security Responsibility 164.308(a)(2) (R)\nWorkforce Security 164.308(a)(3) Authorization and/or Supervision (A)\nWorkforce Clearance Procedure\nTermination Procedures (A)\nInformation Access Management 164.308(a)(4) Isolating Health care Clearinghouse Function (R)\nAccess Authorization (A)\nAccess Establishment and Modification (A)\nSecurity Awareness and Training 164.308(a)(5) Security Reminders (A)\nProtection from Malicious Software (A)\nLog-in Monitoring (A)\nPassword Management (A)\nSecurity Incident Procedures 164.308(a)(6) Response and Reporting (R)\nContingency Plan 164.308(a)(7) Data Backup Plan (R)\nDisaster Recovery Plan (R)\nEmergency Mode Operation Plan (R)\nTesting and Revision Procedure (A)\nApplications and Data Criticality Analysis (A)\nEvaluation 164.308(a)(8) (R)\nBusiness Associate Contracts and Other Arrangement 164.308(b)(1) Written Contract or Other Arrangement (R)\nPhysical Safeguards\nFacility Access Controls 164.310(a)(1) Contingency Operations (A)\nFacility Security Plan (A)\nAccess Control and Validation Procedures (A)\nMaintenance Records (A)\nWorkstation Use 164.310(b) (R)\nWorkstation Security 164.310(c) (R)\nDevice and Media Controls 164.310(d)(1) Disposal (R)\nMedia Re-use (R)\nAccountability (A)\nData Backup and Storage (A)\nTechnical Safeguards (see § 164.312)\nAccess Control 164.312(a)(1) Unique User Identification (R)\nEmergency Access Procedure (R)\nAutomatic Logoff (A)\nEncryption and Decryption (A)\nAudit Controls 164.312(b) (R)\nIntegrity 164.312(c)(1) Mechanism to Authenticate Electronic Protected Health Information (A)\nPerson or Entity Authentication 164.312(d) (R)\nTransmission Security 164.312(e)(1) Integrity Controls (A)\nEncryption (A)","path":["Title 45—Public Welfare","SUBTITLE A—Department of Health and Human Services","SUBCHAPTER C—ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS","PART 164—SECURITY AND PRIVACY","Subpart C—Security Standards for the Protection of Electronic Protected Health Information"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-45.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:26:21Z","sha256":"e2332e10b8525e0fddaf412603cbc60a305547819bc8b9d7f187ae94a6b534b6","source_id":"us-cfr","stale":true,"prev":"us/45-cfr-164.318","next":"us/45-cfr-164.400"},"notice":"GroundRules: Original legal text. Not legal advice."}