§164.310. Physical safeguards. — Inbound Citations

(2) If a State establishes a reinsurance program, the State must ensure that the applicable reinsurance entity implements security standards that provide administrative, physical, and technical safeguards for the personally identifiable information consistent with the security standards described at 45 CFR 164.308, 164.310, and 164.312.

(4) If a State is operating a risk adjustment program, the State must implement security standards that provide administrative, physical, and technical safeguards for the individually identifiable information consistent with the security standards described at 45 CFR 164.308, 164.310, and 164.312.

(2) An issuer must ensure that it and its initial validation auditor comply with the security standards described at 45 CFR 164.308, 164.310, and 164.312 in connection with the initial validation audit, the second validation audit, and any appeal.

(c) A covered entity or business associate must comply with the applicable standards as provided in this section and in §§ 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.