164.314(b)(2) Implementation Specifications for Group Health Plans
164.314(b)(2) in HIPAA Security Rule (the HIPAA Security Rule as it currently stands). All HIPAA Security Rule controls held. Open HIPAA Security Rule on the standards site.
The control as we hold it
Implementation Specifications for Group Health Plans. The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the ePHI; ensure that the adequate separation required by 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures; ensure that any agent to whom it provides such information agrees to implement reasonable and appropriate security measures to protect the information; and report to the group health plan any security incident of which it becomes aware.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
SOC 2
- SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) (closest match)
- SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) (closest match)
- SOC2-CC6.1 CC6.1 Logical access security over protected information assets (closest match)
- SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties (closest match)
- SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-6 AC-6 Least Privilege (closest match)
- NIST800-IR-6 IR-6 Incident Reporting (closest match)
- NIST800-PS-6 PS-6 Access Agreements (closest match)
- NIST800-SC-8 SC-8 Transmission Confidentiality and Integrity (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: Organizational), in our words, not a statement of the standard and not binding on an assessor.
- the signed business-associate agreements
- the review and updated agreements with their record