Checks / Obligations / Protect health information
Obligation · 2 controls · 1 laws
Protect health information
Health information needs extra protection: minimum necessary use, encryption and controlled access.
What to put in place
Map where health information is held, encrypt it, restrict access and keep the HIPAA safeguards evidenced.
Policy wording you can use
[your organisation] uses protected health information only to the minimum necessary, encrypts it at rest and in transit, and grants access only to authorised staff whose role requires it.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 2 controls here that take a yes or a document (the rest need their own number or date and are listed after).