How to HIPAA: Access Management
Free HIPAA guide · 13 controls · 5 templates
ePHI Access: Authorization, Identity Proofing, Authentication, and Termination. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- Technical safeguards
- Controls who can reach ePHI in your systems and records what they do. This is what contains a stolen password or a malicious insider. Without it, one compromised account can quietly read or exfiltrate every record.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 13 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.308(a)(3)(i) · 164.308(a)(3)(ii)(A) · 164.308(a)(3)(ii)(C) · 164.308(a)(4)(i) · 164.308(a)(4)(ii)(A) · 164.308(a)(4)(ii)(B) · 164.308(a)(4)(ii)(C) · 164.308(a)(5)(ii)(D) · 164.312(a)(1) · 164.312(a)(2)(i) · 164.312(a)(2)(ii) · 164.312(a)(2)(iii) · 164.312(d)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Information access management 164.308(a)(4)
- Access control 164.312(a)(1)
- Authentication 164.312(d)
Breach causes reported to HHS that implicate these controls: Hacking/IT · Unauthorized Access
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AdversarialMalicious insider / excess access
Exploits: No least-privilege; no access reviews · 164.308(a)(4) Access Mgmt; 164.312(a) Access Control
- AccidentalAccidental disclosure / over-share
Exploits: No access controls on shares · 164.312(a) Access Control; 164.514(d)
- AdversarialPhishing / credential theft
Exploits: No or weak MFA; reused passwords · 164.312(d) Authentication; 164.308(a)(5) Training
- AccidentalCloud sharing misconfiguration
Exploits: No periodic permissions review · 164.308(a)(4)(ii)(C) Access Review
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 13 controls in this area.
Join Us