45 CFR 164.316, 164.530
HIPAA policies and procedures
Privacy and security policies kept for six years, reviewed and updated, with workforce training and a sanctions policy on record. OCR asks for these first.
- Every version with its approvals and dates, exportable for your six-year file
- Workforce acknowledgment by person and version
- Review dates on each policy

