§ 2.16 Security for records and notification of breaches.

(a) The part 2 program or other lawful holder of patient identifying information must have in place formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information and to protect against reasonably anticipated threats or hazards to the security of patient identifying information.

(1) Requirements for formal policies and procedures. These policies and procedures must address all of the following:

(i) Paper records, including: