DOCUMENTATION STANDARD

CEs must maintain all documentation (e.g., policies, procedures) required by the Security Rule for a period of six years from the date of its creation or the date when it last was in effect, whichever is later. Such documentation must also be made available to the persons responsible for implementing related procedures. Finally, CEs must periodically review such documentation and revise and update it as needed to ensure the confidentiality, integrity, and availability of EPHI.