Under the Administrative Safeguards of the Security Rule (45 CFR § 164.308), Covered Entities and Business Associates are required to “perform a periodic technical and non-technical evaluation […] that establishes the extent to which a Covered Entity´s or Business Associate´s security policies and procedures meet the requirements of the [other] Administrative Safeguards”. Although the standard does not qualify “periodic”, it is a best practice to check annually whether environmental or operational changes have impacted the effectiveness of security policies and procedures. Many Covered Entities and Business Associates take advantage of services provided by external organizations to perform these checks – the external organization issuing a HIPAA certification when each evaluation is complete.