§164.312(e)(1): Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network. Audit Inquiry Does the entity have policies and procedures in place to implement technical security controls to guard against unauthorized access to ePHI transmitted over electronic communications networks? Does the entity have security controls to guard against unauthorized access to ePHI transmitted over electronic communications networks? Obtain and review policies and procedures related to transmission security controls. Evaluate content relative to the specified criteria to determine that the technical security controls implemented guards against unauthorized access to ePHI transmitted over electronic communication networks. Elements to review may include but are not limited to: • Identify the various methods, devices, and networks used to electronically transmit ePHI • The procedures to evaluate and select appropriate technical controls to secure ePHI transmitted across all of its devices and networks • Identify the technical security controls implemented to guard against unauthorized access to ePHI transmitted over electronic communication networks Obtain and review documentation demonstrating the implementation of technical security measures to protect electronic transmissions of ePHI. Evaluate the content in relation to the specified criteria to determine that the implemented technical security measures are sufficient to guard against unauthorized access to the electronically transmitted ePHI. Required/Addressable Required

§164.312(c)(1): Implement policies and procedures to protect electronic protected health information from improper alteration or destruction. Audit Inquiry Does the entity have policies and procedures in place to protect ePHI from improper alteration or destruction? Does the entity protect ePHI form improper alteration or destruction? Obtain and review policies and procedures regarding the implementation of integrity controls to protect ePHI. Evaluate if the implemented integrity controls appropriately protect the entity's ePHI from improper alteration or destruction. Elements to review may include but are not limited to: • What processes are in place to protect ePHI from improper alteration or destruction • How processes protect ePHI from improper alteration or destruction • How processes detect improper alteration or destruction of ePHI • What actions are taken if improper alteration or destruction of ePHI is detected Obtain and review documentation demonstrating processes in place to protect ePHI from improper alteration or destruction. Evaluate and determine whether implementation of process in in accordance with related policies and procedures. Obtain and review documentation demonstrating processes protecting ePHI from improper alteration or destruction. Evaluate and determine whether ePHI is properly protected from alteration or destruction; processes in place to protect ePHI correlates with safeguards identify in integrity control policies and procedures. Required/Addressable Required

§164.312(b): Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. Audit Inquiry Does the entity have policies and procedures in place to implement hardware, software and/or procedural mechanisms to record and examine activity in information systems that contain or use ePHI? Does the entity have hardware, software and/or procedural mechanism to record and examine activity in information systems that contain or use ePHI? Obtain and review documentation relative to audit controls. Evaluate whether risk-based audit controls have been implemented over all electronic information systems that contain or use ePHI. Elements to review may include but are not limited to: • Identification of the risk-based audit controls over all information systems that contain or use ePHI • How are systems and applications evaluated to determine if auditing controls should be implemented • Identification of what applications and systems will be audited • Procedures on how systems will be audited Obtain and review documentation demonstrating the implementation of hardware, software and/or procedural mechanisms to record and examine activity. Evaluate and determine whether information systems that contain or use ePHI activities are being recorded and examined; activities being recorded and examined appropriately and in accordance with related policies and procedures. Required/Addressable Required