--- title: "45 CFR 164.308 HIPAA: Administrative safeguards" canonical: "https://dposchool.com/hipaa/section/164.308" source: "https://www.ecfr.gov/current/title-45/section-164.308" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.308 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart C: Security Standards for the Protection of Electronic Protected Health Information # 45 CFR 164.308 HIPAA: Administrative safeguards eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.308(a) **(a)** A covered entity or business associate must, in accordance with § 164.306: **(1)(i)** Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations. ##### 45 CFR 164.308(a)(ii) **(ii)** Implementation specifications: ###### 45 CFR 164.308(a)(ii)(A) **(A)** Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. ###### 45 CFR 164.308(a)(ii)(B) **(B)** Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a). ###### 45 CFR 164.308(a)(ii)(C) **(C)** Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate. ###### 45 CFR 164.308(a)(ii)(D) **(D)** Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. #### 45 CFR 164.308(a)(2) **(2)** Standard: Assigned security responsibility. Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate. **(3)(i)** Standard: Workforce security. Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information. ##### 45 CFR 164.308(a)(2)(ii) **(ii)** Implementation specifications: ###### 45 CFR 164.308(a)(2)(ii)(A) **(A)** Authorization and/or supervision (Addressable). Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. ###### 45 CFR 164.308(a)(2)(ii)(B) **(B)** Workforce clearance procedure (Addressable). Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate. ###### 45 CFR 164.308(a)(2)(ii)(C) **(C)** Termination procedures (Addressable). Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section. **(4)(i)** Standard: Information access management. Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part. ##### 45 CFR 164.308(a)(2)(ii) **(ii)** Implementation specifications: ###### 45 CFR 164.308(a)(2)(ii)(A) **(A)** Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. ###### 45 CFR 164.308(a)(2)(ii)(B) **(B)** Access authorization (Addressable). Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism. ###### 45 CFR 164.308(a)(2)(ii)(C) **(C)** Access establishment and modification (Addressable). Implement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process. **(5)(i)** Standard: Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management). ##### 45 CFR 164.308(a)(2)(ii) **(ii)** Implementation specifications. Implement: ###### 45 CFR 164.308(a)(2)(ii)(A) **(A)** Security reminders (Addressable). Periodic security updates. ###### 45 CFR 164.308(a)(2)(ii)(B) **(B)** Protection from malicious software (Addressable). Procedures for guarding against, detecting, and reporting malicious software. ###### 45 CFR 164.308(a)(2)(ii)(C) **(C)** Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies. ###### 45 CFR 164.308(a)(2)(ii)(D) **(D)** Password management (Addressable). Procedures for creating, changing, and safeguarding passwords. **(6)(i)** Standard: Security incident procedures. Implement policies and procedures to address security incidents. ##### 45 CFR 164.308(a)(2)(ii) **(ii)** Implementation specification: Response and reporting (Required). Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes. **(7)(i)** Standard: Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information. ##### 45 CFR 164.308(a)(2)(ii) **(ii)** Implementation specifications: ###### 45 CFR 164.308(a)(2)(ii)(A) **(A)** Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information. ###### 45 CFR 164.308(a)(2)(ii)(B) **(B)** Disaster recovery plan (Required). Establish (and implement as needed) procedures to restore any loss of data. ###### 45 CFR 164.308(a)(2)(ii)(C) **(C)** Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode. ###### 45 CFR 164.308(a)(2)(ii)(D) **(D)** Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans. ###### 45 CFR 164.308(a)(2)(ii)(E) **(E)** Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components. #### 45 CFR 164.308(a)(8) **(8)** Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart. **(b)(1)** Business associate contracts and other arrangements. A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor. #### 45 CFR 164.308(a)(2) **(2)** A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with § 164.314(a), that the subcontractor will appropriately safeguard the information. #### 45 CFR 164.308(a)(3) **(3)** Implementation specifications: Written contract or other arrangement (Required). Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of § 164.314(a). ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013\] [45 CFR 164.308 on eCFR](https://www.ecfr.gov/current/title-45/section-164.308) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.308 Previous: [45 CFR 164.306 HIPAA: Security standards: General rules](https://dposchool.com/hipaa/section/164.306) Next: [45 CFR 164.310 HIPAA: Physical safeguards](https://dposchool.com/hipaa/section/164.310) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents