§164.316(b)(2)(iii): Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.
Audit Inquiry
Does the entity have policies and procedures in place to perform periodic reviews and updates to Security Rule policies and procedures?
Obtain and review policies and procedures regarding documentation reviews and updates.
Obtain and review documents demonstrating that policies and procedures are reviewed and updated on a periodic basis. Evaluate and determine if such implementation is in accordance with related policies and procedures.
Required/Addressable
Required