Domain A: Governance & Risk Management
Risk analysis, a risk management plan, and the sanction policy that backs it up.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Written risk analysis completed and dated within the past 12 months
45 C.F.R. §164.308(a)(1)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Risk analysis re-run after the last material system, vendor, or facility change
45 C.F.R. §164.308(a)(1)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Risk management plan with an owner and target date for every identified risk
45 C.F.R. §164.308(a)(1)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Sanction policy written and on file
45 C.F.R. §164.308(a)(1)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Sanction policy applied at least once when warranted, or documented that no violation has occurred
45 C.F.R. §164.308(a)(1)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Information system activity review (log and report review) performed on a defined cadence
45 C.F.R. §164.308(a)(1)(ii)(D) · Source: www.ecfr.gov/current/title-45/section-164.308
Named Security Official on file
45 C.F.R. §164.308(a)(2) · Source: www.ecfr.gov/current/title-45/section-164.308
Periodic technical and non-technical evaluation of security controls (annual self-assessment)
45 C.F.R. §164.308(a)(8) · Source: www.ecfr.gov/current/title-45/section-164.308
ePHI flow and system inventory covers where ePHI is created, enters, moves, is stored and leaves, including mobile, medical and IoT devices
45 C.F.R. §164.308(a)(1)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Risk management policy states risk appetite and tolerance, owners and review frequency, and past risk decisions are re-examined on that schedule
45 C.F.R. §164.308(a)(1)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Sanction policy is tiered, proportional to the harm, and communicated to the workforce before it is applied
45 C.F.R. §164.308(a)(1)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Information system activity review names the reviewer, the frequency, and where the logs are kept, including any cloud service
45 C.F.R. §164.308(a)(1)(ii)(D) · Source: www.ecfr.gov/current/title-45/section-164.308
The security official's responsibility is written into a job description and communicated organization-wide
45 C.F.R. §164.308(a)(2) · Source: www.ecfr.gov/current/title-45/section-164.308
Whether the evaluation is performed internally or externally is decided and documented
45 C.F.R. §164.308(a)(8) · Source: www.ecfr.gov/current/title-45/section-164.308