At least annually, and after any significant change, new EHR, new location, new telehealth platform. Regular updates also demonstrate the good-faith compliance posture that matters if an incident is ever reviewed.