GRCLibrary.ai

Procedure

HIPAA Operational Compliance Procedure

This procedure operationalizes the HIPAA obligations that a covered entity or business associate must execute on a clock: the HIPAA Privacy Rule individual-rights response timelines, the Notice of Privacy Practices and minimum-necessary duties, the cross-rule six-year documentation-retention requirement, the breach-determination test that decides whether the notification clock starts, and the business associate agreement content requirement. It translates the regulatory landscape mapped in the Healthcare Sector GRC Requirements Annex into repeatable operational steps, so a compliance office can run its request-handling, records-retention, breach-response, and vendor-assurance programmes directly.

Type
Procedure
Version
0.0.6
Date
2026-11-03
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Sector-Specific
Review frequency
Annual and upon material change to 45 CFR Part 164
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Governance and accountability
  • 1. Individual right of access
  • 2. Amendment of protected health information
  • 3. Accounting of disclosures
  • 4. Notice of Privacy Practices
  • 5. Minimum necessary
  • 6. Documentation and retention
  • 7. Breach determination and notification
  • 8. Business associate agreements
  • Framework alignment

Frameworks it maps to

Related documents