OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.308

164.308(a)(4)(ii)(A)

paragraph (action item)

Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.

164.308 Administrative safeguards.

Related Frameworks

1 mapping across 5 frameworks
SCF1 mapping
GOV-02Publishing Security, Compliance & Resilience Documentation
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-14Permitted Actions Without Identification or Authentication
1.00
AC-16Security and Privacy Attributes
1.00
AC-17Remote Access
1.00
AC-18Wireless Access
1.00
AC-2Account Management
1.00
AC-24Access Control Decisions
1.00
AC-3Access Enforcement
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.11.1
1.00
CCI0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000001
1.00
CCI-000002
1.00
CCI-000003
1.00
CCI-000004
1.00
CCI-000005
1.00
CCI-000006
1.00
CCI-000100
1.00
CCI-000101
1.00
CCI-000102
1.00
CCI-000103
1.00

+90 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (10) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-239862r953982_ruleThe Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis.
0.50
SV-243442r991589_ruleAdministrators of high-value IT resources must complete required training.
0.50
SV-251654r1028319_ruleCA IDMS must use pervasive encryption to cryptographically protect the confidentiality and integrity of all information at rest in accordance with data owner requirements.
0.50
SV-256877r958482_ruleIndividual user accounts with passwords must be maintained for the Hardware Management Console operating system and application.
0.50
SV-259903r948747_ruleAn inventory of authorized instruments must be documented and maintained in support of the detection of unauthorized instruments connected to the Enterprise Voice, Video, and Messaging system.
0.50
SV-259904r948748_ruleCustomers of the DISN VoSIP service must use address blocks assigned by the DRSN/VoSIP PMO.
0.50
SV-259905r948749_ruleVoice networks must not be bridged via a Unified Capability (UC) soft client accessory.
0.50
SV-259906r948750_ruleWhen soft-phones are implemented as the primary voice endpoint in the user's workspace, a policy must be defined to supplement with physical hardware-based phones near all such workspaces.
0.50
SV-259907r948751_ruleImplementing Unified Capabilities (UC) soft clients as the primary voice endpoint must have authorizing official (AO) approval.
0.50
SV-259908r948752_ruleDeploying Unified Capabilities (UC) soft clients on DOD networks must have authorizing official (AO) approval.
0.50

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.