Resources

This module introduces no new CFR (Code of Federal Regulations) citation and no new external source. It’s pure synthesis — placing a clause module 4 already quoted in full against a process quality-system-essentials already taught in depth — so no new sourcing was needed or attempted this session.

Internal links, not external sources:

• Business Associate Agreements — module 4. The full, verbatim text of 45 CFR 164.314(a)(2)(i)(C) and 164.504(e)(2)(ii)(C) — the incident- reporting clause this module builds its reactive-vs-proactive distinction on — lives there, quoted from sources/cfr/45-164-business-associate-excerpt.md. This module deliberately doesn’t re-quote it at length; go back to module 4 for the full paragraph and the complete (e)(2)(ii)(A)–(J) checklist walkthrough.
• Change control for regulated systems — quality-system-essentials, module 4. The five-stage process (request, impact and risk assessment, approval, implementation, verification) that governs changes to Lakeshore’s own BECS (Blood Establishment Computer Software) and eQMS (electronic quality management system) is taught there in full and referenced, not redeveloped, here. Read it (or re-read it) for the mechanics this module assumes you already have.
• Reading an ISO 27001 Certificate — module 3. Its Statement of Applicability finding on the vendor’s plausible “change management” control domain is the internal-governance half of this module’s central distinction; this module’s other half is the contractual-notice question, which that domain doesn’t answer.
• Investigating a Healthcare Data Incident — the closed incident this course has used as its running example throughout, and the source of the root-cause finding (the deployment-sequencing gap) this module’s change-notification discussion is built to address going forward, without reopening or altering that course’s own final determination.

If a future session wants to verify this module’s reasoning against a real AICPA, ISO, or HHS (Department of Health and Human Services) source, the relevant sourcing notes are already recorded in modules 2–4’s own resources.qmd files and in this course’s plan file (plans/vendor-and-third-party-risk-management.md) — nothing further was fetched for this closing module.