Healthcare

“The manufacturer should consider design controls that will allow the device to detect, resist, respond and recover from cybersecurity attacks.”

“a manufacturer must have a strategy to address the cybersecurity risk of a medical device (Class I to Class IV) that runs software code. This strategy should include...Planning for continued monitoring of and response to emerging risks, vulnerabilities and threats”

“Post-market vigilance: A plan to track, assess, and respond to newly discovered vulnerabilities...This plan should apply throughout the expected service life.”

“Patching: A plan to update the software to maintain the safety and effectiveness of the device either regularly, or in response to an identified vulnerability.”

“Vulnerability Disclosure: A formalized process for obtaining cybersecurity vulnerability information, assessing vulnerabilities, developing mitigation and remediation strategies, and disclosing the existence of vulnerabilities.”

“Manufacturers should incorporate medical device cybersecurity into each device's risk management process...identify any cybersecurity hazard, estimate and evaluate the associated risks, control those risks to an acceptable level, monitor the effectiveness of the risk controls”

“A summary of the device's maintenance plan should be included. The summary should describe the post-market process(es) by which the manufacturer intends to ensure the continued safety and effectiveness of the device throughout its life-cycle.”

“the cybersecurity BOM should include any instructions or information related to: ...Backup and restore features. How users download software/firmware, if applicable...How the device can be hardened in its environment.”

“Features that protect critical functionality of the device, even during a cybersecurity incident.”

“Respond: A defined process or plan should be developed on how the device, manufacturer or user will respond to a cybersecurity event.”

“Detect: Processes or measures should be in place to identify when the device has been compromised due to a cybersecurity event.”

“The manufacturer should consider how the software will be updated to secure the device against newly discovered cybersecurity threats...The manufacturer should consider how often a device will need to be updated via regular and/or routine patches.”

“The manufacturer should consider how operating system software, third-party software (e.g., libraries) or open source software will be updated or controlled.”

“Known Vulnerability Testing...Malware Testing...Malformed Input Testing (i.e., FUZZ testing)...Structured Penetration Testing: This type of testing requires a cybersecurity expert who is familiar with hacking techniques.”

“manufacturers should consider using a cybersecurity vulnerability assessment tool or similar scoring system for rating vulnerabilities and determining the need and urgency of the response.”

“The manufacturer should consider how data transfer to and from the device is secured to prevent unauthorized modification and disruption. Manufacturers should determine how the devices/systems will authenticate each other.”

“shall be provided through the cross-border infrastructure referred to in Article 23.”

“shall also be competent for monitoring and enforcing the application of Articles 3 and 5 to 10 of this Regulation.”

“shall: (a) ensure that the harmonised software components of their EHR systems and the EHR systems themselves, to the extent that this Chapter establishes requirements for them, are in conformity with the essential requirements laid down in Annex II and with the common specificat”

“shall develop a European digital testing environment for the assessment of harmonised software components of EHR systems.”

“shall carry out an evaluation in relation to the EHR system concerned covering all relevant requirements laid down in this Regulation.”

“shall be deemed controller for the making available of personal electronic health data requested pursuant to Article 60(1) to the health data access body.”

“shall support the sharing of best practices and expertise to build capacity within Member States to strengthen digital health systems for primary use and secondary use taking into account the specific circumstances of the different categories of stakeholders involved.”

“shall store and process personal electronic health data in the Union when performing pseudonymisation, anonymisation and any other personal data processing operations referred to in Articles 67 to 72, through secure processing environments within the meaning of Article 73 and Art”

“shall carry out a targeted evaluation of this Regulation, and submit a report on its main findings to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment”

“establish and operate a risk management system across the entire lifecycle of the medical device as a continuous iterative process, requiring regular systematic updating.”

“adopt risk control measures for the design and manufacture of the devices conforming to safety principles and taking account of the generally acknowledged state of the art.”

“the software shall be developed and manufactured in accordance with the state of the art taking into account the principles of development life cycle, risk management, including information security, verification and validation.”

“Manufacturers shall set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended.”

“minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended.”

“devices for use by lay person...shall be designed and manufactured in such a way that they perform appropriately for their intended purpose taking into account the skills and the means available to lay persons.”

“The primary means of security verification and validation is testing. Methods can include security feature testing, fuzz testing, vulnerability scanning and penetration testing.”

“The overall approach for security management for medical devices...The following common eight practices define most of the necessary processes that should be in place to establish a 'Defense-in-Depth strategy'.”

“Threat Modelling techniques are a systematic approach for analysing the security of an item in a structural way such that vulnerabilities can be identified, enumerated, and prioritised.”

“Data Backup and Disaster Recovery [listed as a security capability in Table 3: Indicative list of security Capabilities for MD]”

“during an emergency, the medical personnel must be able to access an implanted cardiac device without restrictions, but strong security measures need to be in place under normal operating conditions.”

“During the support lifetime of the device, the manufacturer should put in place a process to gather post-market information with respect to the security of the device...evaluate the associated security and safety risk and take appropriate measures.”

“Reporting of serious incidents and field safety corrective actions: Article 87...Inform the Electronic System On Vigilance (Article 92)”

“Trend Reporting (Article 88)”

“Analysis of serious incidents and field safety corrective actions: Article 89”

“Security update management...ensure that security updates and security patches associated with the product are tested for regressions and made available to product users in a timely manner.”

“This may include the infield monitoring of the software's vulnerabilities and the possibility to perform a device update...through, for example delivering patches to ensure the continued security of the device.”

“provide and maintain user documentation that describes how to integrate, configure, and maintain the defence in depth strategy of the product in accordance with its product security context.”

“Modification of a medical device, e.g. the installation or enabling of third-party software including software patching, should always be under explicit published guidance of the manufacturer.”

“Assess reasonable level of security for the operating environment; Integrate the system into the environment at the operator site, including secure configuration...Provide support for patching and security incident handling.”

“Ensure required level of security for operational environment...Ensure that prescribed maintenance is done as required, including installation of security patches; Notify the manufacturer without delay of any suspected security event.”

“A medical device should be designed in a layered defence in depth approach and therefore should not rely on security controls in the operating environment.”

“Provide support for patching and security incident handling.”

“shall not apply to such entities.”

“shall designate or establish one or more competent authorities responsible for the management of large-scale cybersecurity incidents and crises (cyber crisis management authorities).”

“shall designate or establish one or more CSIRTs.”

“shall cover at least the sectors, subsectors and types of entity referred to in Annexes I and II, and shall be responsible for incident handling in accordance with a well-defined process.”

“shall comply with the following requirements: (a) the CSIRTs shall ensure a high level of availability of their communication channels by avoiding single points of failure, and shall have several means for being contacted and for contacting others at all times;”

“shall cooperate with each other with regard to the fulfilment of the obligations laid down in this Directive.”

“shall be composed of representatives of the CSIRTs designated or established pursuant to Article 10 and the computer emergency response team for the Union’s institutions, bodies and agencies (CERT-EU).”

“shall be composed of the representatives of Member States’ cyber crisis management authorities as well as, in cases where a potential or ongoing large-scale cybersecurity incident has or is likely to have a significant impact on services and activities falling within the scope of”

“shall include particular policy recommendations, with a view to addressing shortcomings and increasing the level of cybersecurity across the Union, and a summary of the findings for the particular period from the EU Cybersecurity Technical Situation Reports on incidents and cyber”

“shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with”

“shall ensure that an entity that finds that it does not comply with the measures provided for in paragraph 2 takes, without undue delay, all necessary, appropriate and proportionate corrective measures.”

“shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (s”

“shall encourage essential and important entities to use qualified trust services.”

“shall create and maintain a registry of DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed secur”

“shall ensure that entities falling within the scope of this Directive and, where relevant, other entities not falling within the scope of this Directive are able to exchange on a voluntary basis relevant cybersecurity information among themselves, including information relating t”

“shall ensure that, in addition to the notification obligation provided for in Article 23, notifications can be submitted to the CSIRTs or, where applicable, the competent authorities, on a voluntary basis, by: (a) essential and important entities with regard to incidents, cyber t”

“shall ensure that the supervisory or enforcement measures imposed on essential entities in respect of the obligations laid down in this Directive are effective, proportionate and dissuasive, taking into account the circumstances of each individual case.”

“shall ensure that the competent authorities take action, where necessary, through ex post supervisory measures.”

“shall apply mutatis mutandis to the supervisory and enforcement measures provided for in this Article for important entities.”

“shall, without undue delay, inform the supervisory authorities as referred to in Article 55 or 56 of that Regulation.”

“shall cooperate with and assist each other as necessary.”

“modify the Security Risk Analysis measure to require eligible hospitals and CAHs to attest 'yes' to having conducted security risk management in addition to the existing measure requirement to attest 'yes' to having conducted security risk analysis, beginning with the EHR reporti”

“modify the SAFER Guides measure by requiring eligible hospitals and CAHs to attest 'yes' to completing an annual self-assessment using the eight SAFER Guides published in January 2025, beginning with the EHR reporting period in CY 2026”

“The hospital must develop and maintain a comprehensive emergency preparedness program that meets the requirements of this section, utilizing an all-hazards approach.”

“The hospital must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years. The plan must...Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.”

“Address patient population, including, but not limited to, persons at-risk; the type of services the hospital has the ability to provide in an emergency; and continuity of operations, including delegations of authority and succession plans.”

“Include a process for cooperation and collaboration with local, tribal, regional, State, and Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation.”

“The hospital must develop and implement emergency preparedness policies and procedures, based on the emergency plan...risk assessment...and the communication plan...The policies and procedures must be reviewed and updated at least every 2 years.”

“The provision of subsistence needs for staff and patients, whether they evacuate or shelter in place, include, but are not limited to the following: (i) Food, water, medical, and pharmaceutical supplies. (ii) Alternate sources of energy...”

“Alternate sources of energy to maintain the following: (A) Temperatures to protect patient health and safety....(B) Emergency lighting. (C) Fire detection, extinguishing, and alarm systems. (D) Sewage and waste disposal.”

“A system to track the location of on-duty staff and sheltered patients in the hospital's care during an emergency. If on-duty staff and sheltered patients are relocated during the emergency, the hospital must document the specific name and location of the receiving facility.”

“Safe evacuation from the hospital, which includes consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance.”

“A means to shelter in place for patients, staff, and volunteers who remain in the facility.”

“A system of medical documentation that preserves patient information, protects confidentiality of patient information, and secures and maintains the availability of records.”

“The development of arrangements with other hospitals and other providers to receive patients in the event of limitations or cessation of operations to maintain the continuity of services to hospital patients.”

“The hospital must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least every 2 years.”

“Primary and alternate means for communicating with the following: (i) Hospital's staff. (ii) Federal, State, tribal, regional, and local emergency management agencies.”

“A method for sharing information and medical documentation for patients under the hospital's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the hospital's occupancy, needs, and its ability to provide assistance, to the authority having jurisdiction, the Incident Command Center, or designee.”

“The hospital must develop and maintain an emergency preparedness training and testing program that is based on the emergency plan...risk assessment...policies and procedures...and the communication plan...reviewed and updated at least every 2 years.”

“Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers...Provide emergency preparedness training at least every 2 years. Maintain documentation of the training. Demonstrate”

“The hospital must conduct exercises to test the emergency plan at least twice per year...Participate in an annual full-scale exercise that is community-based...Conduct an additional annual exercise that may include...a tabletop exercise or workshop...”

“Analyze the hospital's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan, as needed.”

“The hospital must implement emergency and standby power systems based on the emergency plan...The generator must be located in accordance with the location requirements found in the Health Care Facilities Code (NFPA 99...Life Safety Code (NFPA 101...and NFPA 110, when a new struc”

“The hospital must implement the emergency power system inspection, testing, and maintenance requirements found in the Health Care Facilities Code, NFPA 110, and Life Safety Code.”

“Hospitals that maintain an onsite fuel source to power emergency generators must have a plan for how it will keep emergency power systems operational during the emergency, unless it evacuates.”

“Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program...Demonstrate that each separately certified facility is capable of actively using the unified and integrate”

“A representative from each transplant program must be included in the development and maintenance of the hospital's emergency preparedness program; and...The hospital must develop and maintain mutually agreed upon protocols that address the duties and responsibilities of the hosp”

“The HHA must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years. The plan must... Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.”

“Include strategies for addressing emergency events identified by the risk assessment... continuity of operations, including delegations of authority and succession plans.”

“Include a process for cooperation and collaboration with local, tribal, regional, State, and Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation.”

“The HHA must develop and implement emergency preparedness policies and procedures, based on the emergency plan... risk assessment... and the communication plan... The policies and procedures must be reviewed and updated at least every 2 years.”

“The plans for the HHA's patients during a natural or man-made disaster. Individual plans for each patient must be included as part of the comprehensive patient assessment.”

“The procedures to inform State and local emergency preparedness officials about HHA patients in need of evacuation from their residences at any time due to an emergency situation based on the patient's medical and psychiatric condition and home environment.”

“The procedures to follow up with on-duty staff and patients to determine services that are needed, in the event that there is an interruption in services... The HHA must inform State and local officials of any on-duty staff or patients that they are unable to contact.”

“A system of medical documentation that preserves patient information, protects confidentiality of patient information, and secures and maintains the availability of records.”

“The use of volunteers in an emergency or other emergency staffing strategies, including the process and role for integration of State or Federally designated health care professionals to address surge needs during an emergency.”

“The HHA must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least every 2 years.”

“Primary and alternate means for communicating with the HHA's staff, Federal, State, tribal, regional, and local emergency management agencies.”

“A method for sharing information and medical documentation for patients under the HHA's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the HHA's needs, and its ability to provide assistance, to the authority having jurisdiction, the Incident Command Center, or designee.”

“The HHA must develop and maintain an emergency preparedness training and testing program that is based on the emergency plan... risk assessment... policies and procedures... and the communication plan... reviewed and updated at least every 2 years.”

“Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles.”

“Provide emergency preparedness training at least every 2 years.”

“Maintain documentation of the training.”

“Demonstrate staff knowledge of emergency procedures.”

“If the emergency preparedness policies and procedures are significantly updated, the HHA must conduct training on the updated policies and procedures.”

“The HHA must conduct exercises to test the emergency plan at least annually... Participate in a full-scale exercise that is community-based; or... conduct an annual individual, facility-based functional exercise every 2 years.”

“Conduct an additional exercise every 2 years, opposite the year the full-scale or functional exercise... is conducted, that may include... A second full-scale exercise... or A mock disaster drill; or A tabletop exercise or workshop.”

“Analyze the HHA's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the HHA's emergency plan, as needed.”

“Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program... Demonstrate that each separately certified facility is capable of actively using the unified and integrat”

“A documented community-based risk assessment, utilizing an all-hazards approach. (ii) A documented individual facility-based risk assessment for each separately certified facility within the health system, utilizing an all-hazards approach.”

“Include integrated policies and procedures that meet the requirements set forth in paragraph (b) of this section, a coordinated communication plan and training and testing programs that meet the requirements of paragraphs (c) and (d) of this section, respectively.”

“The ASC must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years.”

“Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.”

“Include strategies for addressing emergency events identified by the risk assessment.”

“Address patient population, including, but not limited to, the type of services the ASC has the ability to provide in an emergency; and continuity of operations, including delegations of authority and succession plans.”

“Include a process for cooperation and collaboration with local, tribal, regional, State, and Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation.”

“The ASC must develop and implement emergency preparedness policies and procedures, based on the emergency plan...The policies and procedures must be reviewed and updated at least every 2 years.”

“A system to track the location of on-duty staff and sheltered patients in the ASC's care during an emergency. If on-duty staff or sheltered patients are relocated during the emergency, the ASC must document the specific name and location of the receiving facility.”

“Safe evacuation from the ASC, which includes the following: (i) Consideration of care and treatment needs of evacuees. (ii) Staff responsibilities. (iii) Transportation. (iv) Identification of evacuation location(s). (v) Primary and alternate means of communication with external ”

“A means to shelter in place for patients, staff, and volunteers who remain in the ASC.”

“A system of medical documentation that does the following: (i) Preserves patient information. (ii) Protects confidentiality of patient information. (iii) Secures and maintains the availability of records.”

“The ASC must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least every 2 years.”

“Primary and alternate means for communicating with the following: (i) ASC's staff. (ii) Federal, State, tribal, regional, and local emergency management agencies.”

“A method for sharing information and medical documentation for patients under the ASC's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the ASC's needs, and its ability to provide assistance, to the authority having jurisdiction, the Incident Command Center, or designee.”

“The ASC must develop and maintain an emergency preparedness training and testing program...The training and testing program must be reviewed and updated at least every 2 years.”

“Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing on-site services under arrangement, and volunteers...Provide emergency preparedness training at least every 2 years.”

“Maintain documentation of all emergency preparedness training. (iv) Demonstrate staff knowledge of emergency procedures.”

“If the emergency preparedness policies and procedures are significantly updated, the ASC must conduct training on the updated policies and procedures.”

“The ASC must conduct exercises to test the emergency plan at least annually...Participate in a full-scale exercise that is community-based every 2 years; or...conduct a facility-based functional exercise every 2 years.”

“Conduct an additional exercise at least every 2 years, opposite the year the full-scale or functional exercise...is conducted, that may include...A mock disaster drill; or...A tabletop exercise or workshop.”

“Analyze the ASC's response to and maintain documentation of all drills, tabletop exercises, and emergency events and revise the ASC's emergency plan, as needed.”

“Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program. (2) Be developed and maintained in a manner that takes into account each separately certified facility's un”

“Demonstrate that each separately certified facility is capable of actively using the unified and integrated emergency preparedness program and is in compliance.”

“A documented community-based risk assessment, utilizing an all-hazards approach. (ii) A documented individual facility-based risk assessment for each separately certified facility within the health system, utilizing an all-hazards approach.”

“Include integrated policies and procedures that meet the requirements set forth in paragraph (b) of this section, a coordinated communication plan and training and testing programs that meet the requirements of paragraphs (c) and (d) of this section, respectively.”

“The LTC facility must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually.”

“continuity of operations, including delegations of authority and succession plans.”

“Include a process for cooperation and collaboration with local, tribal, regional, State, or Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation.”

“The LTC facility must develop and implement emergency preparedness policies and procedures...The policies and procedures must be reviewed and updated at least annually.”

“The provision of subsistence needs for staff and residents, whether they evacuate or shelter in place, include, but are not limited to...Food, water, medical, and pharmaceutical supplies. Alternate sources of energy...”

“Alternate sources of energy to maintain— Temperatures to protect resident health and safety...Emergency lighting; Fire detection, extinguishing, and alarm systems; and Sewage and waste disposal.”

“A system to track the location of on-duty staff and sheltered residents in the LTC facility's care during and after an emergency...document the specific name and location of the receiving facility or other location.”

“Safe evacuation from the LTC facility, which includes consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication.”

“A means to shelter in place for residents, staff, and volunteers who remain in the LTC facility.”

“A system of medical documentation that preserves resident information, protects confidentiality of resident information, and secures and maintains the availability of records.”

“The development of arrangements with other LTC facilities and other providers to receive residents in the event of limitations or cessation of operations to maintain the continuity of services to LTC residents.”

“The LTC facility must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least annually.”

“Names and contact information for the following: Staff. Entities providing services under arrangement. Residents' physicians. Other LTC facilities. Volunteers. Contact information for...Federal, State, tribal, regional, or local emergency preparedness staff.”

“Primary and alternate means for communicating with the following: LTC facility's staff. Federal, State, tribal, regional, or local emergency management agencies.”

“A method for sharing information and medical documentation for residents under the LTC facility's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the LTC facility's occupancy, needs, and its ability to provide assistance, to the authority having jurisdiction or the Incident Command Center, or designee.”

“The LTC facility must develop and maintain an emergency preparedness training and testing program...The training and testing program must be reviewed and updated at least annually.”

“Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers...Provide emergency preparedness training at least annually.”

“Maintain documentation of the training. Demonstrate staff knowledge of emergency procedures.”

“The LTC facility must conduct exercises to test the emergency plan at least twice per year, including unannounced staff drills using the emergency procedures.”

“Analyze the LTC facility's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the LTC facility's emergency plan, as needed.”

“The generator must be located in accordance with the location requirements found in the Health Care Facilities Code (NFPA 99...Life Safety Code (NFPA 101...and NFPA 110, when a new structure is built or when an existing structure or building is renovated.”

“The LTC facility must implement the emergency power system inspection, testing, and maintenance requirements found in the Health Care Facilities Code, NFPA 110, and Life Safety Code.”

“LTC facilities that maintain an onsite fuel source to power emergency generators must have a plan for how it will keep emergency power systems operational during the emergency, unless it evacuates.”

“Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program...each separately certified facility is capable of actively using the unified and integrated emergency prepa”

“The dialysis facility must develop and maintain an emergency preparedness plan that must be evaluated and updated at least every 2 years.”

“Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.”

“Include strategies for addressing emergency events identified by the risk assessment.”

“continuity of operations, including delegations of authority and succession plans.”

“The dialysis facility must contact the local emergency preparedness agency at least annually to confirm that the agency is aware of the dialysis facility's needs in the event of an emergency.”

“The dialysis facility must develop and implement emergency preparedness policies and procedures...The policies and procedures must be reviewed and updated at least every 2 years.”

“A system to track the location of on-duty staff and sheltered patients in the dialysis facility's care during and after an emergency...the dialysis facility must document the specific name and location of the receiving facility.”

“Safe evacuation from the dialysis facility, which includes staff responsibilities, and needs of the patients.”

“A means to shelter in place for patients, staff, and volunteers who remain in the facility.”

“A system of medical documentation that preserves patient information, protects confidentiality of patient information, and secures and maintains the availability of records.”

“The development of arrangements with other dialysis facilities or other providers to receive patients in the event of limitations or cessation of operations to maintain the continuity of services to dialysis facility patients.”

“The dialysis facility must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least every 2 years.”

“Names and contact information for the following: Staff...Entities providing services under arrangement...Patients' physicians...Other dialysis facilities...Volunteers.”

“Primary and alternate means for communicating with the following: Dialysis facility's staff...Federal, State, tribal, regional, or local emergency management agencies.”

“A method for sharing information and medical documentation for patients under the dialysis facility's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the dialysis facility's needs, and its ability to provide assistance, to the authority having jurisdiction or the Incident Command Center, or designee.”

“The dialysis facility must develop and maintain an emergency preparedness training, testing and patient orientation program...evaluated and updated at least every 2 years.”

“Provide initial training in emergency preparedness policies and procedures to all new and existing staff...Provide emergency preparedness training at least every 2 years...the dialysis facility must conduct training on the updated policies and procedures.”

“Demonstrate staff knowledge of emergency procedures, including informing patients of what to do; where to go...whom to contact if an emergency occurs...How to disconnect themselves from the dialysis machine if an emergency occurs.”

“The dialysis facility must conduct exercises to test the emergency plan at least annually...Participate in a full-scale exercise that is community-based every 2 years.”

“Conduct an additional exercise every 2 years, opposite the year the full-scale or functional exercise...is conducted, that may include...a tabletop exercise or workshop that is led by a facilitator.”

“Analyze the dialysis facility's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the dialysis facility's emergency plan, as needed.”

“The facility must provide appropriate orientation and training to patients, including the areas specified in paragraph (d)(1) of this section.”

“The CAH must develop and maintain a comprehensive emergency preparedness program, utilizing an all-hazards approach.”

“The CAH must develop and maintain an emergency preparedness plan that must be reviewed and updated at least every 2 years.”

“Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.”

“Include strategies for addressing emergency events identified by the risk assessment.”

“Address patient population, including, but not limited to, persons at-risk; the type of services the CAH has the ability to provide in an emergency; and continuity of operations, including delegations of authority and succession plans.”

“Include a process for cooperation and collaboration with local, tribal, regional, State, and Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation.”

“The CAH must develop and implement emergency preparedness policies and procedures, based on the emergency plan...The policies and procedures must be reviewed and updated at least every 2 years.”

“The provision of subsistence needs for staff and patients, whether they evacuate or shelter in place, include, but are not limited to—(i) Food, water, medical, and pharmaceutical supplies; (ii) Alternate sources of energy...”

“A system to track the location of on-duty staff and sheltered patients in the CAH's care during an emergency. If on-duty staff and sheltered patients are relocated during the emergency, the CAH must document the specific name and location of the receiving facility.”

“Safe evacuation from the CAH, which includes consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance.”

“A means to shelter in place for patients, staff, and volunteers who remain in the facility.”

“A system of medical documentation that preserves patient information, protects confidentiality of patient information, and secures and maintains the availability of records.”

“The development of arrangements with other CAHs or other providers to receive patients in the event of limitations or cessation of operations to maintain the continuity of services to CAH patients.”

“The CAH must develop and maintain an emergency preparedness communication plan that complies with Federal, State, and local laws and must be reviewed and updated at least every 2 years.”

“Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Patients' physicians. (iv) Other CAHs and hospitals. (v) Volunteers.”

“Contact information for the following: (i) Federal, State, tribal, regional, and local emergency preparedness staff. (ii) Other sources of assistance.”

“Primary and alternate means for communicating with the following: (i) CAH's staff. (ii) Federal, State, tribal, regional, and local emergency management agencies.”

“A method for sharing information and medical documentation for patients under the CAH's care, as necessary, with other health care providers to maintain the continuity of care.”

“A means of providing information about the CAH's occupancy, needs, and its ability to provide assistance, to the authority having jurisdiction or the Incident Command Center, or designee.”

“The CAH must develop and maintain an emergency preparedness training and testing program that is based on the emergency plan...The training and testing program must be reviewed and updated at least every 2 years.”

“Initial training in emergency preparedness policies and procedures, including prompt reporting and extinguishing of fires, protection, and where necessary, evacuation of patients, personnel, and guests...to all new and existing staff, individuals providing services under arrangem”

“Provide emergency preparedness training at least every 2 years.”

“Maintain documentation of the training.”

“Demonstrate staff knowledge of emergency procedures.”

“If the emergency preparedness policies and procedures are significantly updated, the CAH must conduct training on the updated policies and procedures.”

“The CAH must conduct exercises to test the emergency plan at least twice per year.”

“Participate in an annual full-scale exercise that is community-based; or (A) When a community-based exercise is not accessible, conduct an annual individual, facility-based functional exercise.”

“Conduct an annual additional exercise, that may include, but is not limited to the following: (A) A second full-scale exercise...or (B) A mock disaster drill; or (C) A tabletop exercise or workshop...”

“Analyze the CAH's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the CAH's emergency plan, as needed.”

“The CAH must implement emergency and standby power systems based on the emergency plan set forth in paragraph (a) of this section.”

“The generator must be located in accordance with the location requirements found in the Health Care Facilities Code (NFPA 99...Life Safety Code (NFPA 101...) and NFPA 110, when a new structure is built or when an existing structure or building is renovated.”

“The CAH must implement emergency power system inspection and testing requirements found in the Health Care Facilities Code, NFPA 110, and the Life Safety Code.”

“CAHs that maintain an onsite fuel source to power emergency generators must have a plan for how it will keep emergency power systems operational during the emergency, unless it evacuates.”

“Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program.”

“Be developed and maintained in a manner that takes into account each separately certified facility's unique circumstances, patient populations, and services offered.”

“Demonstrate that each separately certified facility is capable of actively using the unified and integrated emergency preparedness program and is in compliance with the program.”

“The unified and integrated emergency plan must also be based on and include—(i) A documented community-based risk assessment, utilizing an all-hazards approach. (ii) A documented individual facility-based risk assessment for each separately certified facility within the health sy”

“a manufacturer shall— (I) quarantine such product within the possession or control of the manufacturer from product intended for distribution until such product is cleared or dispositioned; and (II) promptly conduct an investigation in coordination with trading partners”

“the manufacturer shall notify the Secretary and all immediate trading partners that the manufacturer has reason to believe may have received such illegitimate product of such determination not later than 24 hours after making such determination.”

“A manufacturer shall notify the Secretary and immediate trading partners…not later than 24 hours after determining or being notified by the Secretary or a trading partner that there is a high risk that such product is an illegitimate product.”

“a manufacturer shall, not later than 1 business day, and not to exceed 48 hours, after receiving the request…provide the applicable transaction information, transaction history, and transaction statement for the product.”

“A manufacturer may satisfy the requirements of this paragraph by developing a secure electronic database or utilizing a secure electronic database developed or operated by another entity…shall not relieve a manufacturer of the requirement…to respond to a request for verification ”

“a wholesale distributor shall, not later than 1 business day, and not to exceed 48 hours, after receiving the request…provide the applicable transaction information, transaction history, and transaction statement for the product.”

“the dispenser shall notify the Secretary and all immediate trading partners that the dispenser has reason to believe may have received such illegitimate product of such determination not later than 24 hours after making such determination.”

“a dispenser shall, not later than 2 business days after receiving the request or in another such reasonable time as determined by the Secretary…provide the applicable transaction information, transaction statement, and transaction history which the dispenser received from the pre”

“a repackager shall— (I) quarantine such product within the possession or control of the repackager from product intended for distribution until such product is cleared or dispositioned; and (II) promptly conduct an investigation in coordination with trading partners, as applicabl”

“the repackager shall notify the Secretary and all immediate trading partners that the repackager has reason to believe may have received the illegitimate product of such determination not later than 24 hours after making such determination.”

“a repackager…shall, not later than 1 business day, and not to exceed 48 hours, after receiving the request…provide the applicable transaction information, transaction history, and transaction statement for the product.”

“The systems and processes necessary to promptly facilitate gathering the information necessary to produce the transaction information for each transaction going back to the manufacturer, as applicable, shall be required— (i) in the event of a request by the Secretary…on account o”

“A dispenser may enter into a written agreement with a third party…under which the third party confidentially maintains the transaction information, transaction history, and transaction statements…the dispenser shall maintain a copy of the written agreement and shall not be reliev”

“submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures”

“design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure”

“make available postmarket updates and patches to the device and related systems to address— (A) on a reasonably justified regular cycle, known unacceptable vulnerabilities”

“as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks”

“comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure”

“An applicant of a prescription drug product must notify FDA in writing of a permanent discontinuance of manufacture of the drug product or an interruption in manufacturing...that is likely to lead to a meaningful disruption in supply”

“Notifications required by paragraph (b)(3)(iii)(a) of this section must be submitted to FDA electronically in a format that FDA can process, review, and archive: At least 6 months prior to the date of the permanent discontinuance or interruption”

“If 6 months' advance notice is not possible because the permanent discontinuance or interruption in manufacturing was not reasonably anticipated 6 months in advance, as soon as practicable thereafter, but in no case later than 5 business days”

“Notifications required by paragraph (b)(3)(iii)(a) of this section must include the following information: The name of the drug...the name of the applicant; Whether the notification relates to a permanent discontinuance...A description of the reason...The estimated duration”

“require a regulated entity to inventory its technology assets and map the movement of ePHI through its information systems would illuminate considerations to be included in the regulated entity's risk analysis”

“regulated entities are already required to conduct an accurate and thorough risk analysis...an accurate and thorough risk analysis requires a regulated entity to perform an inventory of its technology assets”

“regulated entities must ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit; protect against reasonably anticipated threats or hazards to the security or integrity of the information”

“regulated entities must implement administrative, physical, and technical safeguards to protect ePHI”

“regulated entities must implement administrative, physical, and technical safeguards to protect ePHI”

“Adding a Definition of 'Multi-factor Authentication' (MFA)”

“protect against reasonably anticipated threats or hazards to the security or integrity of the information and reasonably anticipated impermissible uses or disclosures”

“The proposed modifications would explicitly codify those activities that are critical to protecting the security of ePHI as requirements and provide greater detail for such requirements in the regulatory text”

“The HITECH Act extends the application of the Security Rule's provisions on administrative, physical, and technical safeguards and documentation requirements to business associates of covered entities”

“The HITECH Act extends the application of the Security Rule's provisions on administrative, physical, and technical safeguards and documentation requirements to business associates of covered entities, making those business associates subject to civil and criminal liability”

“Modifying the Definition of 'Malicious software'”

“otherwise ensure compliance with HIPAA by the officers and employees of covered entities”

“The value of audit trails in computerized record systems”

“Adding a Definition of 'Vulnerability'...protect against reasonably anticipated threats or hazards to the security or integrity of the information”

“Clarifying the Definition of 'Workstation'”

“The proposed modifications would explicitly codify those activities that are critical to protecting the security of ePHI as requirements and provide greater detail for such requirements in the regulatory text”

“ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit”

“Health IT Performance Exception--When will an actor's practice that is implemented to maintain or improve health IT performance and that is likely to interfere with the access, exchange, or use of EHI not be considered information blocking?”

“Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.”

“Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.”

“Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.”

“Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans.”

“Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components.”

“Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.”

“Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.”

“Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”

“Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).”

“Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information.”

“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”

“A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information.”

“Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.”

“Updates (Required). Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.”

“Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.”

“Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information...Report to the group health plan any security incident of which it becomes aware”

“Data backup and storage (Addressable). Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.”

“The finalized 45 CFR part 172 establishes the processes associated with the qualifications necessary for an entity to receive and maintain Designation as a Qualified Health Information Network (QHIN) capable of trusted exchange under the Common Agreement.”

“The final provisions codified in part 172 also establish the procedures governing Onboarding (as defined in Sec. 172.102) of QHINs and Designation of QHINs, suspension, termination, and administrative appeals to ASTP/ONC.”

“The final provisions codified in part 172 also establish the procedures governing Onboarding (as defined in Sec. 172.102) of QHINs and Designation of QHINs, suspension, termination, and administrative appeals to ASTP/ONC.”

“we proposed to add the 'decision support interventions' certification criterion (Sec. 170.315(b)(11)) to the list of certification criteria in Sec. 170.550(h)(3)(ii)... 'emergency access' in Sec. 170.315(d)(6)”

“We believe establishing these provisions in regulation support reliability, privacy, security, and trust within TEFCA, which furthers our obligations to 'support' TEFCA under sections 3001(c)(9)(A) and (B) of the PHSA and TEFCA's ultimate success.”

“The practice must be directly related to safeguarding the confidentiality, integrity, and availability of electronic health information.”

“Provide objective timeframes and other parameters for identifying, responding to, and addressing security incidents.”

“Implemented for a period of time no longer than necessary to complete the maintenance or improvements for which the health IT was made unavailable or the health IT's performance degraded; Implemented in a consistent and non-discriminatory manner.”

“Planned. Consistent with existing service level agreements between the individual or entity to whom the health IT developer of certified health IT, health information exchange, or health information network supplied the health IT.”

“Unplanned. Consistent with existing service level agreements between the individual or entity; or agreed to by the individual or entity to whom the health IT developer of certified health IT, health information exchange, or health information network supplied the health IT.”

“For a period of time no longer than necessary to resolve any negative impacts; Implemented in a consistent and non-discriminatory manner.”

“Consistent with existing service level agreements, where applicable.”

“If the unavailability of health IT for maintenance or improvements is initiated by an actor in response to a risk of harm to a patient or another person, the actor does not need to satisfy the requirements of this section, but must comply with all requirements of § 171.201 at all”

“If the unavailability of health IT for maintenance or improvements is initiated by an actor in response to a security risk to electronic health information, the actor does not need to satisfy the requirements of this section, but must comply with all requirements of § 171.203 at ”

“The actor cannot fulfill the request for access, exchange, or use of electronic health information because of a natural or human-made disaster, public health emergency, public safety incident, war, terrorist attack, civil insurrection, strike or other labor unrest, telecommunicat”

“Have been prepared on the basis of, and be directly responsive to, security risks identified and assessed by or on behalf of the actor.”

“Align with one or more applicable consensus-based standards or best practice guidance.”

“Consistent with existing service level agreements, where applicable.”