OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.530

164.530(i)(4)(ii)

paragraph (action item)

If a covered entity has not reserved its right under § 164.520(b)(1)(v)(C) to change a privacy practice that is stated in the notice, the covered entity is bound by the privacy practices as stated in the notice with respect to protected health information created or received while such notice is in effect. A covered entity may change a privacy practice that is stated in the notice, and the related policies and procedures, without having reserved the right to do so, provided that:

164.530 Administrative requirements.

Related Frameworks

1 mapping across 4 frameworks
SCF1 mapping
PRI-05.4Usage Restrictions of Personal Data (PD)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-2Account Management
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AT-1Policy and Procedures
1.00
AT-3(5)Processing Personally Identifiable Information
1.00
AU-1Policy and Procedures
1.00
AU-13Monitoring for Information Disclosure
1.00
AU-16Cross-organizational Audit Logging
1.00
AU-9Protection of Audit Information
1.00

+59 more (top 10 by confidence shown)

CCI0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-002343
0.50
CCI-002344
0.50
CCI-002345
0.50
CCI-002346
0.50
CCI-002347
0.50
CCI-004425
0.50
CCI-004426
0.50
CCI-004427
0.50
CCI-004428
0.50
CCI-004429
0.50

+12 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-204980r831357_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-204981r831358_ruleTo protect against data mining, the ALG providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-204982r831359_ruleTo protect against data mining, the ALG providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
0.50
SV-204983r831360_ruleTo protect against data mining, the ALG providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-204984r831361_ruleTo protect against data mining, the ALG providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
0.50
SV-204985r831362_ruleTo protect against data mining, the ALG providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-206895r1137746_ruleTo protect against unauthorized data mining, the IPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-206895r856533_ruleTo protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
0.50
SV-206896r1137749_ruleTo protect against unauthorized data mining, the IPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50
SV-206896r856534_ruleTo protect against unauthorized data mining, the IDPS must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
0.50

+43 more (top 10 by confidence shown)

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.