Healthcare

42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records

HHS rule protecting the confidentiality of substance use disorder patient records; the HHS Office for Civil Rights enforces it.

Biosafety in Microbiological and Biomedical Laboratories (BMBL), 6th Edition

CDC and NIH advisory guidance on biosafety practices and containment levels for laboratories working with infectious agents and toxins.

California Confidentiality of Medical Information Act (CMIA)

California law (Civil Code §56 et seq.) limiting how health care providers, health plans, contractors and others use and disclose medical information.

California Consumer Privacy Act (CCPA), as amended by the CPRA

California consumer privacy law, amended by the CPRA, enforced by the Attorney General and the California Privacy Protection Agency (CalPrivacy).

CAP Laboratory Accreditation Program

College of American Pathologists accreditation programs for laboratories, including the Laboratory Accreditation Program and CAP 15189.

Clinical Laboratory Improvement Amendments (CLIA)

Federal quality standards for US laboratories testing human specimens, administered by CMS with CDC and FDA under 42 CFR Part 493.

CMS Emergency Preparedness Rule

CMS rule requiring Medicare and Medicaid participating providers and suppliers to maintain emergency plans, procedures, communication, training and …

Common Rule (45 CFR Part 46) and IRB Oversight

HHS regulations at 45 CFR Part 46 protecting human research subjects and governing IRB review, overseen by the Office for Human Research Protections.

Current Good Manufacturing Practice (CGMP) for Drugs

FDA current good manufacturing practice regulations for drug manufacturing, processing, packing and holding (21 CFR Parts 210 and 211).

Cyber Insurance Readiness

Topic entry: no single framework governs cyber insurance; insurers assess cyber risk in their own underwriting. Links regulator references.

Data Retention and Secure Destruction

Index of US federal sources on records retention and media sanitization, including HIPAA documentation rules, 21 CFR Part 11 and NIST SP 800-88.

Drug Supply Chain Security Act (DSCSA)

US law setting up electronic, interoperable tracing of prescription drug packages through the supply chain, implemented by the FDA.

EU Artificial Intelligence Act (Regulation (EU) 2024/1689)

EU regulation setting risk-based rules for AI systems and general-purpose AI models, amended in 2026 by Regulation (EU) 2026/1744.

EU In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR)

EU regulation for in vitro diagnostic medical devices, applicable since 26 May 2022, with legacy-device transitions running to 2027-2029.

EU Medical Device Regulation (EU) 2017/745

EU regulation setting safety and performance requirements for medical devices placed on the EU market, adopted by the European Parliament and Council.

FDA 21 CFR Part 11: Electronic Records and Electronic Signatures

FDA regulation, 21 CFR Part 11, setting criteria under which electronic records and electronic signatures are accepted in place of paper records.

FDA Artificial Intelligence-Enabled Medical Devices

FDA guidance and resources for medical devices with AI-enabled software functions, including predetermined change control plans (PCCPs).

FDA Device Software Functions and Mobile Medical Applications

FDA guidance on which software functions and mobile apps FDA regulates as medical devices and where it applies enforcement discretion.

FDA Quality Management System Regulation (21 CFR Part 820)

FDA's Quality Management System Regulation for medical device manufacturers, effective 2026-02-02, incorporating ISO 13485:2016 by reference.

Federal Risk and Authorization Management Program (FedRAMP)

GSA's government-wide program that assesses and certifies the security of cloud services used by US federal agencies.

General Data Protection Regulation (EU) 2016/679

EU regulation on the processing of personal data, adopted by the European Parliament and Council and enforced by national supervisory authorities.

Good Clinical Practice (ICH E6(R3))

International standard for the design, conduct and reporting of clinical trials (ICH E6(R3)), issued by FDA as final guidance in the US.

Health Industry Cybersecurity Practices (HICP), HHS 405(d) Program

Voluntary cybersecurity practices for health care organizations from the HHS 405(d) program, published on the HHS Cyber Gateway.

Health Information Technology for Economic and Clinical Health (HITECH) Act

2009 US law that strengthened HIPAA privacy, security, breach notification and enforcement; HHS OCR enforces the HIPAA rules that implement it.

Healthcare Accessibility under the ADA and Section 504

Federal disability rights rules for health care under the ADA and Section 504, enforced by the HHS Office for Civil Rights and the Department of …

HIPAA Business Associate Contracts

HHS requirements and sample provisions for HIPAA business associate contracts between covered entities and their service providers.

ICH E6(R3) Good Clinical Practice

ICH's international guideline for the ethical and scientific conduct of clinical trials, revised as E6(R3), with Annex 2 adopted in June 2026.

IEC 62304 Medical Device Software: Software Life Cycle Processes

IEC international standard for medical device software life cycle processes; the current text is the 2006 edition plus Amendment 1 (2015).

IEC 62366-1 Medical Devices: Application of Usability Engineering

IEC standard for applying usability engineering to medical devices to reduce use-related risk. Current: IEC 62366-1:2015+AMD1:2020.

ISO 13485:2016 Medical Devices Quality Management Systems

International standard from ISO setting quality management system requirements for organizations involved in the medical device life cycle.

ISO 14971:2019 Medical Devices: Application of Risk Management to Medical Devices

ISO international standard for risk management across the life cycle of medical devices, including in vitro diagnostic devices; third edition 2019.

ISO 9001 Quality Management Systems: Requirements

ISO international standard setting requirements for a quality management system. Current edition: ISO 9001:2026.

ISO/IEC 27001 Information Security Management Systems

ISO/IEC 27001:2022 is the ISO and IEC standard specifying requirements for an information security management system (ISMS).

ISO/IEC 27017 Information Security Controls Based on ISO/IEC 27002 for Cloud Services

ISO/IEC guidance on information security controls for cloud service providers and customers, based on ISO/IEC 27002. Current edition: 2026.

ISO/IEC 27018:2025 Protection of PII in Public Clouds

ISO/IEC guidelines for protecting personally identifiable information in public clouds where the provider acts as a PII processor. 2025 edition.

Massachusetts PATCH Act (An Act to Protect Access to Confidential Healthcare)

2018 Massachusetts law on health insurer summary of payments forms that protects confidential care; the Division of Insurance implements it.

Medicare and Medicaid Provider Enrollment

CMS requirements for enrolling and revalidating as a Medicare provider or supplier through PECOS, with Medicaid enrollment rules in 42 CFR 455.

Medicare Clinical Trial Policy (NCD 310.1)

CMS national coverage determination 310.1 on Medicare payment for routine costs in qualifying clinical trials.

Mental Health Parity and Addiction Equity Act (MHPAEA)

Federal law requiring parity between mental health and substance use disorder benefits and medical/surgical benefits in health plans.

NCI Best Practices for Biospecimen Resources

National Cancer Institute best practices for biospecimen resources: governance, collection, processing, storage, retrieval and dissemination of …

New York SHIELD Act (General Business Law §§899-aa, 899-bb)

New York law setting data security safeguards and breach notice rules for private information of New York residents, enforced by the Attorney General.

NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules

NIH biosafety requirements for research with recombinant or synthetic nucleic acid molecules at institutions that receive NIH support for such …

NIST Cybersecurity Framework (CSF) 2.0

NIST guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

NIST SP 800-53 Rev. 5 Security and Privacy Controls

NIST catalog of security and privacy controls for information systems and organizations, developed under FISMA. Current: Rev. 5, Release 5.2.0.

OSHA Laboratory Standard (29 CFR 1910.1450)

OSHA standard on occupational exposure to hazardous chemicals in laboratories, requiring a Chemical Hygiene Plan, training and exposure controls.

Outbreak Investigation and Infection Control

Topic entry for outbreak investigation and infection control, pointing to CDC outbreak resources and related OSHA, CMS and state requirements.

Payment Card Industry Data Security Standard (PCI DSS)

PCI Security Standards Council standard for protecting payment account data wherever it is stored, processed or transmitted. Current: v4.0.1.

PCI Data Security Standard (PCI DSS) for Healthcare Payments

PCI Security Standards Council standard for protecting payment card data, current version v4.0.1, applying to any entity handling card data.

Pharmacy Licensing and DEA Registration

State pharmacy board licensure and DEA controlled substance registration under 21 CFR Part 1301 for pharmacies, practitioners and researchers.

Professional Liability Insurance Regulation (State Insurance Regulators and NAIC)

U.S. professional liability insurance is regulated by the states; NAIC, governed by the state insurance regulators, publishes model laws.

Public Health Reporting and Surveillance

State-mandated reporting of notifiable diseases by providers and labs to health departments, which share case data with CDC through NNDSS.

Remote Patient Monitoring (RPM)

Federal sources on remote patient monitoring, including HHS telehealth guidance and CMS Medicare physician fee schedule billing rules.

Research Data Management and FAIR Principles

Research data management and sharing practices, including the FAIR principles and the NIH Data Management and Sharing Policy for NIH-funded work.

Resource Conservation and Recovery Act (RCRA) Hazardous Waste Regulations

EPA's hazardous waste program under RCRA, which regulates hazardous waste from generation through transport, treatment, storage and disposal.

SAMHSA Grants: Federal Award Requirements

Requirements for SAMHSA grant recipients under SAMHSA award terms, the HHS Grants Policy Statement, and federal award rules at 2 CFR 200 and 300.

SOC 2 (System and Organization Controls 2)

AICPA examination of service organization controls under the Trust Services Criteria: security, availability, processing integrity, confidentiality, …

Telehealth Policy and Regulation

Federal and state rules for care delivered by telehealth, covering licensure, controlled substance prescribing, privacy and Medicare payment.

Texas Medical Records Privacy Act (Health and Safety Code Chapter 181)

Texas Health and Safety Code Chapter 181, Medical Records Privacy, sets state rules for protected health information held by covered entities.

U.S. National Pandemic Influenza Strategy and HHS Pandemic Influenza Plan

Federal pandemic influenza planning documents, including the National Strategy for Pandemic Influenza and the HHS Pandemic Influenza Plan, indexed by …

Unique Device Identification (UDI): FDA and EU

Medical device identification rules requiring a UDI on labels, with device data in FDA's GUDID in the US and EUDAMED in the EU.

Vendor and Third-Party Risk Management

Index of US federal sources on managing vendor and supply chain security risk, including HIPAA business associate rules and NIST SP 800-161.