Practical guidance on AI governance and HIPAA compliance, written for the people who run the program.
Subscribe by RSS to hear when a new post is published
March 18, 2026
45 CFR 164.312(a)(2)(ii) covers emergency access procedure. This post walks through emergency access that does not become a back door, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →March 17, 2026
45 CFR 164.312(a)(2)(i) covers unique user identification. This post walks through unique user identification and why shared logins fail, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →March 16, 2026
45 CFR 164.312(a)(1) covers access control. This post walks through technical access control and least privilege, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full; the addressable implementation specifications beneath it are each assessed and documented on their own.
Read more →March 13, 2026
45 CFR 164.310(d)(2)(iv) covers data backup and storage. This post walks through backing up data before you move equipment, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →March 12, 2026
45 CFR 164.310(d)(2)(iii) covers accountability. This post walks through accountability for hardware that moves, with the language of the requirement itself and the evidence an assessor asks to see. It is an addressable implementation specification, which means documenting your reasoning is part of the requirement.
Read more →March 11, 2026
45 CFR 164.310(d)(2)(ii) covers media re-use. This post walks through media re-use between patients and departments, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →March 10, 2026
45 CFR 164.310(d)(2)(i) covers disposal. This post walks through disposal that actually destroys the data, with the language of the requirement itself and the evidence an assessor asks to see. It is a required implementation specification, so there is no documented-alternative route.
Read more →March 9, 2026
45 CFR 164.310(d)(1) covers device and media controls. This post walks through tracking devices and media that hold ePHI, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full; the addressable implementation specifications beneath it are each assessed and documented on their own.
Read more →March 6, 2026
45 CFR 164.310(c) covers workstation security. This post walks through workstation security where patients can see screens, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full and there is no documented-alternative route.
Read more →March 5, 2026
45 CFR 164.310(b) covers workstation use. This post walks through workstation use rules for shared clinical machines, with the language of the requirement itself and the evidence an assessor asks to see. It is a standard, so it must be met in full and there is no documented-alternative route.
Read more →