OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.514

164.514(f)(2)(i)

paragraph (action item)

A covered entity may not use or disclose protected health information for fundraising purposes as otherwise permitted by paragraph (f)(1) of this section unless a statement required by § 164.520(b)(1)(iii)(A) is included in the covered entity's notice of privacy practices.

164.514 Other requirements relating to uses and disclosures of protected health information.

Related Frameworks

1 mapping across 4 frameworks
SCF1 mapping
PRI-05.4Usage Restrictions of Personal Data (PD)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-2Account Management
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AT-1Policy and Procedures
1.00
AT-3(5)Processing Personally Identifiable Information
1.00
AU-1Policy and Procedures
1.00
AU-13Monitoring for Information Disclosure
1.00
AU-16Cross-organizational Audit Logging
1.00
AU-9Protection of Audit Information
1.00

+59 more (top 10 by confidence shown)

CCI0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-002343
0.50
CCI-002344
0.50
CCI-002345
0.50
CCI-002346
0.50
CCI-002347
0.50
CCI-004425
0.50
CCI-004426
0.50
CCI-004427
0.50
CCI-004428
0.50
CCI-004429
0.50

+12 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-204980r831357_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-204981r831358_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-204982r831359_ruleTo protect against data mining, the ALG providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
0.50
SV-204983r831360_ruleTo protect against data mining, the ALG providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-204984r831361_ruleTo protect against data mining, the ALG providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
0.50
SV-204985r831362_ruleTo protect against data mining, the ALG providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-206895r1137746_ruleTo protect against unauthorized data mining, the IPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-206895r856533_ruleTo protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-206896r1137749_ruleTo protect against unauthorized data mining, the IPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-206896r856534_ruleTo protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50

+43 more (top 10 by confidence shown)

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.