# HIPAA 164.316

URL: /systems/trust-and-governance/criteria/hipaa/164-316 · Id: `criterion:hipaa:164.316`

> The entity documents its security policies and procedures and retains that documentation for six years.

The entity documents its security policies and procedures and retains that documentation for six years.

| Property | Value |
| --- | --- |
| Framework | HIPAA |
| Reference | `164.316` |
| Satisfied by | [Policy approval](/systems/trust-and-governance/controls/policy-approval) |