---
kind: "section"
citation: "45 C.F.R. § 164.316"
title: "45"
number: "164.316"
heading: "Policies and procedures and documentation requirements."
url: "https://uscodex.org/cfr/45/164.316"
---

# §164.316. Policies and procedures and documentation requirements.


A covered entity or business associate must, in accordance with [§ 164.306](/cfr/45/164.306.md):

- (a) **Standard: Policies and procedures.** Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § [164.306(b)(2)(i)](/cfr/45/164.306.md?p=b-2-i), [(ii)](/cfr/45/164.306.md?p=b-2-ii), [(iii)](/cfr/45/164.306.md?p=b-2-iii), and [(iv)](/cfr/45/164.306.md?p=b-2-iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.
- (b)
  - (1) **Standard: Documentation.**
    - (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and
    - (ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.
  - (2) **Implementation specifications—**
    - (i) **Time limit (Required).** Retain the documentation required by [paragraph (b)(1)](#b-1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
    - (ii) **Availability (Required).** Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.
    - (iii) **Updates (Required).** Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.

## Notes

### Amendments

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5695, Jan. 25, 2013]

### Authority

Authority: 42 U.S.C. 1320d-2 and 1320d-4; sec. 13401, Pub. L. 111-5, 123 Stat. 260.

### Source

Source: 68 FR 8376, Feb. 20, 2003, unless otherwise noted.

### Authority

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Source

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

### Amendments

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5695, Jan. 25, 2013]