policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments
For policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments, regulation is 45 CFR 164.316; regulator / programme is HHS (HIPAA); retention period is 6 years; when the clock starts is from the date of its creation or the date when it last was in effect, whichever is later; who it binds is a covered entity or business associate, recorded from its source on 2026-08-11.
- Regulation
- 45 CFR 164.316 verified
- Regulator / programme
- HHS (HIPAA) our reading
- Record type
- policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments verified
- Retention period
- 6 years verified
- When the clock starts
- from the date of its creation or the date when it last was in effect, whichever is later verified
- Who it binds
- a covered entity or business associate
- Exceptions and notes
- documentation must be reviewed periodically and updated as needed in response to environmental or operational changes affecting the security of the electronic protected health information
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
( i ) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and ( ii ) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment. ( 2 ) Implementation specifications: ( i ) Time limit (Required). Retain the documentation required by <https://www.ecfr.gov/current/title-45/section-164.316#p-164.316(b)(1)> paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
— ecfr.gov, retrieved 2026-08-11
Source
- ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316