Requirements our products support

HIPAA

Health Insurance Portability and Accountability Act: Privacy, Security, Breach Notification and transaction rules

30 citations, for example “HIPAA Security Rule (45 CFR Part 164, Subpart C)”.

HITECH Act

Health Information Technology for Economic and Clinical Health Act

1 citation, for example “HITECH Act”.

42 CFR Part 2

Confidentiality of Substance Use Disorder Patient Records

2 citations, for example “Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)”.

Information blocking rule (45 CFR Part 171)

21st Century Cures Act information blocking rules

3 citations, for example “21st Century Cures Act information blocking rule (45 CFR Part 171)”.

CMS Conditions of Participation for hospitals (42 CFR Part 482)

Medicare and Medicaid hospital Conditions of Participation

21 citations, for example “CMS Conditions of Participation for Hospitals (42 CFR Part 482)”.

EMTALA

Emergency Medical Treatment and Labor Act

3 citations, for example “EMTALA (42 U.S.C. 1395dd) and its on-call list requirement (42 CFR 489.20(r)(2) and 489.24(j))”.

The Joint Commission standards

Joint Commission accreditation standards

9 citations, for example “The Joint Commission Medical Staff (MS) standards”.

FDA 21 CFR Part 11

Electronic records and electronic signatures

2 citations, for example “FDA electronic records and signatures (21 CFR Part 11)”.

FDA medical device reporting (21 CFR Part 803)

Medical device reporting for user facilities

2 citations, for example “FDA Medical Device Reporting, user facility requirements (21 CFR Part 803)”.

FDA postmarket cybersecurity guidance for medical devices

Postmarket Management of Cybersecurity in Medical Devices

2 citations, for example “FDA guidance on postmarket management of cybersecurity in medical devices”.

IEC 80001-1

Risk management for IT networks incorporating medical devices

2 citations, for example “ANSI/AAMI/IEC 80001-1 (safety, effectiveness and security in networks incorporating medical devices)”.

Common Rule (45 CFR Part 46)

Federal Policy for the Protection of Human Subjects

2 citations, for example “Federal Policy for the Protection of Human Subjects (Common Rule, 45 CFR Part 46)”.

ICH E6 Good Clinical Practice

2 citations, for example “ICH E6 Good Clinical Practice”.

Section 1557 of the Affordable Care Act

Nondiscrimination, language access and effective communication (45 CFR Part 92)

2 citations, for example “Section 1557 of the Affordable Care Act (45 CFR Part 92), language access and effective communication”.

HHS 405(d) Health Industry Cybersecurity Practices

3 citations, for example “HHS 405(d) Health Industry Cybersecurity Practices (HICP)”.

HHS Healthcare and Public Health Cybersecurity Performance Goals

2 citations, for example “HHS Healthcare and Public Health Cybersecurity Performance Goals”.

CDC National Healthcare Safety Network (NHSN) reporting

2 citations, for example “CDC NHSN Antimicrobial Use and Resistance (AUR) Module”.

ACGME requirements

Accreditation Council for Graduate Medical Education requirements

5 citations, for example “ACGME Common Program Requirements (Fellowship)”.

OSHA Bloodborne Pathogens Standard

29 CFR 1910.1030

1 citation, for example “OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)”.

NFPA 99 Health Care Facilities Code

1 citation, for example “NFPA 99 Health Care Facilities Code”.

GLBA

Gramm-Leach-Bliley Act: safeguards and privacy rules, including the FTC Safeguards Rule and Regulation P

13 citations, for example “Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)”.

Interagency Guidelines Establishing Information Security Standards

The banking agencies’ information security standards under GLBA Section 501(b)

7 citations, for example “Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)”.

NCUA Security Program (12 CFR Part 748)

Credit union security program and customer information rules

5 citations, for example “NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)”.

NYDFS 23 NYCRR Part 500

New York Department of Financial Services Cybersecurity Regulation

9 citations, for example “NYDFS Cybersecurity Regulation (23 NYCRR Part 500)”.

SEC Regulation S-P (17 CFR Part 248)

Privacy and safeguarding of consumer financial information

10 citations, for example “Regulation S-P (17 CFR Part 248)”.

FFIEC IT Examination Handbook and IT guidance

Federal Financial Institutions Examination Council

11 citations, for example “FFIEC IT Examination Handbook, Information Security booklet”.

Bank Secrecy Act and anti-money laundering rules

Including FinCEN rules and the USA PATRIOT Act

7 citations, for example “FinCEN Customer Due Diligence Rule (31 CFR 1010.230)”.

OFAC sanctions regulations

Office of Foreign Assets Control (31 CFR Chapter V)

1 citation, for example “OFAC sanctions regulations (31 CFR Chapter V)”.

Model risk management guidance (SR 11-7)

Supervisory guidance on model risk management

6 citations, for example “Interagency Guidance on Model Risk Management (SR 11-7)”.

Interagency Guidance on Third-Party Relationships

Third-party risk management

2 citations, for example “Interagency Guidance on Third-Party Relationships: Risk Management (2023)”.

Sarbanes-Oxley Act

2 citations, for example “Sarbanes-Oxley Act Section 404 (internal control over financial reporting)”.

SEC Rule 17a-4 and FINRA Rule 4511 (books and records)

6 citations, for example “FINRA Rule 4511 (General Requirements for books and records)”.

FINRA Rule 3110 (supervision)

4 citations, for example “FINRA Rule 3110 (supervision)”.

FINRA Rule 2210 (communications with the public)

2 citations, for example “FINRA Rule 2210 (Communications with the Public)”.

SEC Marketing Rule (Rule 206(4)-1)

2 citations, for example “SEC Marketing Rule (17 CFR 275.206(4)-1), for illustrations shared by investment advisers”.

CFTC recordkeeping rules

Commodity Futures Trading Commission regulations 1.31, 1.35 and 23.202

4 citations, for example “CFTC Regulation 1.35 (records of commodity interest and related cash or forward transactions, including oral communications)”.

MiFID II recording of communications (Article 16(7))

2 citations, for example “MiFID II Article 16(7) (recording of telephone conversations relating to client orders)”.

FCA Handbook recording rules

UK Financial Conduct Authority

2 citations, for example “FCA Handbook COBS 11.8 (recording telephone conversations and electronic communications)”.

Regulation Z (12 CFR Part 1026)

Truth in Lending

2 citations, for example “Regulation Z (12 CFR Part 1026), including TILA-RESPA integrated disclosure timing”.

PCI DSS

Payment Card Industry Data Security Standard

5 citations, for example “PCI DSS, through your payment processor”.

CJIS Security Policy

FBI Criminal Justice Information Services

4 citations, for example “FBI CJIS Security Policy”.

Privacy Act of 1974

5 U.S.C. 552a

2 citations, for example “Privacy Act of 1974 (5 U.S.C. 552a)”.

Freedom of Information Act

5 U.S.C. 552

1 citation, for example “Freedom of Information Act (5 U.S.C. 552)”.

Federal Records Act

44 U.S.C. Chapter 31

3 citations, for example “Federal Records Act (44 U.S.C. Chapter 31)”.

State public records laws

5 citations, for example “State public-records laws”.

State open meetings laws

2 citations, for example “State open meetings laws for board hearings and deliberations”.

FISMA

Federal Information Security Modernization Act of 2014

3 citations, for example “Federal Information Security Modernization Act (44 U.S.C. 3551 et seq.)”.

FedRAMP

Federal Risk and Authorization Management Program

2 citations, for example “FedRAMP Authorization Act (44 U.S.C. 3607 to 3616)”.

OMB Circular A-130

Managing Information as a Strategic Resource

1 citation, for example “OMB Circular A-130, Managing Information as a Strategic Resource”.

Controlled Unclassified Information (CUI)

32 CFR Part 2002 and DoD Instruction 5200.48

4 citations, for example “Controlled Unclassified Information program (32 CFR Part 2002)”.

DoD RMF (DoDI 8510.01)

Risk Management Framework for DoD Systems

2 citations, for example “DoD Instruction 8510.01, Risk Management Framework for DoD Systems”.

DoD Instruction 8500.01, Cybersecurity

1 citation, for example “DoD Instruction 8500.01, Cybersecurity”.

CNSSI 1253

Security Categorization and Control Selection for National Security Systems

2 citations, for example “CNSSI 1253, Security Categorization and Control Selection for National Security Systems”.

DoD Information Security Program (DoDM 5200.01)

3 citations, for example “DoD Manual 5200.01, DoD Information Security Program”.

Classified national security information (EO 13526, 32 CFR Part 2001)

3 citations, for example “Executive Order 13526, Classified National Security Information”.

NISPOM (32 CFR Part 117)

National Industrial Security Program Operating Manual

3 citations, for example “32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)”.

Intelligence Community Directive 503

IC Information Technology Systems Security Risk Management

1 citation, for example “Intelligence Community Directive 503, IC Information Technology Systems Security Risk Management”.

Executive Order 12333

United States Intelligence Activities

1 citation, for example “Executive Order 12333, United States Intelligence Activities”.

Executive Order 14028

Improving the Nation’s Cybersecurity

1 citation, for example “Executive Order 14028, Improving the Nation's Cybersecurity”.

ITAR

International Traffic in Arms Regulations

1 citation, for example “International Traffic in Arms Regulations (22 CFR Parts 120-130)”.

DISA STIGs

Security Technical Implementation Guides

2 citations, for example “DISA Kubernetes Security Technical Implementation Guide (STIG)”.

Section 889 (FY2019 NDAA)

Prohibition on certain telecommunications and video surveillance equipment

2 citations, for example “Section 889 of the FY2019 John S. McCain National Defense Authorization Act (FAR 52.204-25)”.

Uniform Guidance (2 CFR Part 200)

Federal award requirements, cost principles and Single Audit

5 citations, for example “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 200)”.

HSPD-12 and FIPS 201 (PIV)

Personal Identity Verification

2 citations, for example “HSPD-12 and FIPS 201-3 (Personal Identity Verification)”.

NIST SP 800-53

Security and Privacy Controls for Information Systems and Organizations

6 citations, for example “NIST SP 800-53 Rev. 5, Security and Privacy Controls”.

NIST SP 800-37 Risk Management Framework

1 citation, for example “NIST SP 800-37 Rev. 2, Risk Management Framework”.

NIST SP 800-63 Digital Identity Guidelines

3 citations, for example “NIST SP 800-63 Digital Identity Guidelines (identity proofing for online requests)”.

NIST SP 800-161 supply chain risk management

2 citations, for example “NIST SP 800-161 Rev. 1 (Cybersecurity Supply Chain Risk Management Practices)”.

NIST SP 800-88 media sanitization

1 citation, for example “NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization”.

NIST AI Risk Management Framework

AI RMF 1.0

2 citations, for example “NIST AI Risk Management Framework (AI RMF 1.0)”.

Zero trust architecture

NIST SP 800-207, OMB M-22-09 and the DoD Zero Trust Strategy

4 citations, for example “DoD Zero Trust Strategy and Zero Trust Reference Architecture”.

FIPS 140-3

Security Requirements for Cryptographic Modules

1 citation, for example “FIPS 140-3, Security Requirements for Cryptographic Modules”.

E-SIGN Act

Electronic Signatures in Global and National Commerce Act

5 citations, for example “ESIGN consumer consent requirements (15 U.S.C. 7001(c))”.

Uniform Electronic Transactions Act (UETA)

2 citations, for example “Electronic Signatures in Global and National Commerce Act (E-SIGN) and state Uniform Electronic Transactions Act enactments”.

TCPA

Telephone Consumer Protection Act (47 U.S.C. 227)

4 citations, for example “Telephone Consumer Protection Act (47 U.S.C. 227) and FCC rules (47 CFR 64.1200)”.

Section 508

Section 508 of the Rehabilitation Act

2 citations, for example “Section 508 of the Rehabilitation Act”.

WCAG 2.1

Web Content Accessibility Guidelines

1 citation, for example “WCAG 2.1 Level AA”.

ADA Title II

Americans with Disabilities Act, Title II (28 CFR Part 35)

5 citations, for example “ADA Title II web accessibility rule (28 CFR Part 35, Subpart H)”.