OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.530

164.530(i)(2)(ii)

paragraph (action item)

When a covered entity changes a privacy practice that is stated in the notice described in § 164.520, and makes corresponding changes to its policies and procedures, it may make the changes effective for protected health information that it created or received prior to the effective date of the notice revision, if the covered entity has, in accordance with § 164.520(b)(1)(v)(C), included in the notice a statement reserving its right to make such a change in its privacy practices; or

164.530 Administrative requirements.

Related Frameworks

1 mapping across 4 frameworks
SCF1 mapping
GOV-03Periodic Review & Update of Security, Compliance & Resilience Program
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-14Permitted Actions Without Identification or Authentication
1.00
AC-16Security and Privacy Attributes
1.00
AC-17Remote Access
1.00
AC-18Wireless Access
1.00
AC-19Access Control for Mobile Devices
1.00
AC-2Account Management
1.00
AC-24Access Control Decisions
1.00

+90 more (top 10 by confidence shown)

CCI0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000001
1.00
CCI-000002
1.00
CCI-000003
1.00
CCI-000004
1.00
CCI-000005
1.00
CCI-000006
1.00
CCI-000100
1.00
CCI-000101
1.00
CCI-000102
1.00
CCI-000103
1.00

+90 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (10) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-239862r953982_ruleThe Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis.
0.50
SV-243442r991589_ruleAdministrators of high-value IT resources must complete required training.
0.50
SV-251654r1028319_ruleCA IDMS must use pervasive encryption to cryptographically protect the confidentiality and integrity of all information at rest in accordance with data owner requirements.
0.50
SV-256877r958482_ruleIndividual user accounts with passwords must be maintained for the Hardware Management Console operating system and application.
0.50
SV-259903r948747_ruleAn inventory of authorized instruments must be documented and maintained in support of the detection of unauthorized instruments connected to the Enterprise Voice, Video, and Messaging system.
0.50
SV-259904r948748_ruleCustomers of the DISN VoSIP service must use address blocks assigned by the DRSN/VoSIP PMO.
0.50
SV-259905r948749_ruleVoice networks must not be bridged via a Unified Capability (UC) soft client accessory.
0.50
SV-259906r948750_ruleWhen soft-phones are implemented as the primary voice endpoint in the user's workspace, a policy must be defined to supplement with physical hardware-based phones near all such workspaces.
0.50
SV-259907r948751_ruleImplementing Unified Capabilities (UC) soft clients as the primary voice endpoint must have authorizing official (AO) approval.
0.50
SV-259908r948752_ruleDeploying Unified Capabilities (UC) soft clients on DOD networks must have authorizing official (AO) approval.
0.50

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.