Evaluation
Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of ePHI.
Implementation Guidance
• Regular security assessments and evaluations
• Technical evaluation of security controls
• Non-technical evaluation of policies and procedures
• Environmental change impact assessments
• Operational change impact assessments
• Evaluation documentation and reporting
• Remediation planning and tracking
Key components:
- Periodic security evaluations
- Technical control assessments
- Policy and procedure reviews
- Change impact assessments
- Documentation of evaluation results
- Remediation planning and tracking
Required Documentation
• Technical evaluation criteria and methods
• Non-technical evaluation criteria and methods
• Environmental change assessment procedures
• Operational change assessment procedures
• Evaluation documentation templates
• Remediation planning procedures
• Evaluation reporting procedures
Best Practices
• Use standardized evaluation criteria
• Document all evaluation results
• Assess impact of all changes
• Develop remediation plans
• Track remediation progress
• Regular reporting to management
• Continuous improvement of evaluation processes
Common Violations
• Inadequate technical control assessments
• Insufficient policy and procedure reviews
• Failure to assess impact of changes
• Inadequate documentation of evaluations
• Lack of remediation planning
• Insufficient evaluation reporting
Testing Procedures
• Verify technical evaluation methods
• Test non-technical evaluation processes
• Review change impact assessment procedures
• Verify evaluation documentation
• Test remediation planning procedures
• Review evaluation reporting
• Conduct evaluation exercises
Implementation Resources
Download expert-developed templates and checklists to implement this control:
Quick Facts
Related Controls
Explore other controls in the Administrative Safeguards category.
Security Officer
A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures....
Workforce Security
Implement policies and procedures to ensure that all members of the workforce have appropriate access to electronic protected health information (ePHI...
Security Awareness and Training
Implement a security awareness and training program for all members of the workforce (including management)....
Need Help Implementing This Control?
Our certified HIPAA experts can help you implement this control correctly and efficiently.