[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR160.310]

[Page 673-674]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                           AND HUMAN SERVICES
 
PART 160--GENERAL ADMINISTRATIVE REQUIREMENTS--Table of Contents
 
                  Subpart C--Compliance and Enforcement
 
Sec. 160.310  Responsibilities of covered entities.

    (a) Provide records and compliance reports. A covered entity must 
keep such records and submit such compliance reports, in such time and 
manner and containing such information, as the Secretary may determine 
to be necessary to enable the Secretary to ascertain whether the covered 
entity has complied or is complying with the applicable requirements of 
this part 160 and the applicable standards, requirements, and 
implementation specifications of subpart E of part 164 of this 
subchapter.
    (b) Cooperate with complaint investigations and compliance reviews. 
A covered entity must cooperate with the Secretary, if the Secretary 
undertakes an investigation or compliance review of the policies, 
procedures, or practices of a covered entity to determine whether it is 
complying with the applicable requirements of this part 160 and the 
standards, requirements, and implementation specifications of subpart E 
of part 164 of this subchapter.
    (c) Permit access to information. (1) A covered entity must permit 
access by the Secretary during normal business hours to its facilities, 
books, records, accounts, and other sources of information, including 
protected health information, that are pertinent to ascertaining 
compliance with the applicable requirements of this part 160 and the 
applicable standards, requirements, and implementation specifications of 
subpart E of part 164 of this

[[Page 674]]

subchapter. If the Secretary determines that exigent circumstances 
exist, such as when documents may be hidden or destroyed, a covered 
entity must permit access by the Secretary at any time and without 
notice.
    (2) If any information required of a covered entity under this 
section is in the exclusive possession of any other agency, institution, 
or person and the other agency, institution, or person fails or refuses 
to furnish the information, the covered entity must so certify and set 
forth what efforts it has made to obtain the information.
    (3) Protected health information obtained by the Secretary in 
connection with an investigation or compliance review under this subpart 
will not be disclosed by the Secretary, except if necessary for 
ascertaining or enforcing compliance with the applicable requirements of 
this part 160 and the applicable standards, requirements, and 
implementation specifications of subpart E of part 164 of this 
subchapter, or if otherwise required by law.