For security must be in writing and updated whenever there is a change that can affect EHR security. Any time a policy is changed, the old policy must be accessible for review for 6 years.