HealthData DueCare™Home
← All domains
Domain K: Recognized Security Practices (NIST CSF 2.0 Governance Bridge)
The NIST CSF 2.0 governance bridge behind Recognized Security Practices, real HITECH mitigating-factor credit if you can show twelve continuous months of it.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Cybersecurity supply chain risk management extends beyond BAA-centric due diligence to supplier concentration risk, fourth-party (N-tier) visibility, and component/software provenance
Optional
45 C.F.R. §164.308(b); 164.314(a) · Source: www.ecfr.gov/current/title-45/section-164.308