Question

Though the HIPAA Security Rule does not specify audit frequency, how often should an organization's security policies and procedures be reviewed?
a Once every six months
b Once a year
c Every two years
d Every five years