HIPAA Breach Notification Rule 164.414: Administrative requirements, documentation and burden of proof

A covered entity or business associate bears the burden of demonstrating that all required notifications were made, or that a use or disclosure did not constitute a breach, and must maintain documentation sufficient to meet that burden, applying the Privacy Rule's 164.530 administrative-requirement provisions (policies and procedures, training, sanctions, and the six-year documentation retention at 164.530(j)) to this subpart, per 164.414.