OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/SP 800-66 Rev 2 (HIPAA guide)/164.308

164.308(a)(8)

Evaluation

HIPAA standard

HIPAA Standard: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity’s or business associate’s security policies and procedures meet the requirements of this subpart.

164.308 Administrative Safeguards Defined in the Security Rule as the “administrative actions and policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information.”

Related Frameworks

3 mappings across 4 frameworks
SCF3 mappings
CPL-03.2Functional Review Of Security, Compliance & Resilience Controls
1.00
IAO-01.1Assessment Boundaries
1.00
IAO-02Assessments
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-4Information Flow Enforcement
1.00
AT-1Policy and Procedures
1.00
AU-1Policy and Procedures
1.00
CA-1Policy and Procedures
1.00
CA-2Control Assessments
1.00
CA-2(1)Independent Assessors
1.00
CA-3Information Exchange
1.00
CA-5Plan of Action and Milestones
1.00
CA-7Continuous Monitoring
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.11.1
1.00
3.11.2
1.00
3.11.3
1.00
3.12.1
1.00
3.12.2
1.00
3.12.3
1.00
3.12.4
1.00
3.13.1
1.00
3.13.2
1.00
3.14.1
1.00

+7 more (top 10 by confidence shown)

CCI0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000001
1.00
CCI-000002
1.00
CCI-000003
1.00
CCI-000004
1.00
CCI-000005
1.00
CCI-000006
1.00
CCI-000100
1.00
CCI-000101
1.00
CCI-000102
1.00
CCI-000103
1.00

+90 more (top 10 by confidence shown)

NIST, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. Edition dated 2024-02-14. Read the publication.