OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.502

164.502(e)(1)(ii)

paragraph (action item)

A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

164.502 Uses and disclosures of protected health information: General rules.

Related Frameworks

2 mappings across 4 frameworks
SCF2 mappings
TPM-05.2Contract Flow-Down Requirements
1.00
TPM-05.6First-Party Declaration (1PD)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-20Use of External Systems
1.00
AC-20(1)Limits on Authorized Use
1.00
AC-20(3)Non-organizationally Owned Systems — Restricted Use
1.00
AT-1Policy and Procedures
1.00
AU-1Policy and Procedures
1.00
CA-1Policy and Procedures
1.00
CM-1Policy and Procedures
1.00
CP-1Policy and Procedures
1.00
IA-1Policy and Procedures
1.00

+59 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.11.1
1.00
3.11.2
1.00
3.11.3
1.00
3.1.1
0.50
CCI0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000001
1.00
CCI-000002
1.00
CCI-000003
1.00
CCI-000004
1.00
CCI-000005
1.00
CCI-000006
1.00
CCI-000100
1.00
CCI-000101
1.00
CCI-000102
1.00
CCI-000103
1.00

+90 more (top 10 by confidence shown)

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.