Access Control Policy

Policy

1. Least privilege and role-based access (164.312(a)(1), 164.308(a)(4)(i))

Access to ePHI and supporting systems is granted only as required to perform an assigned role. [Organization] defines role-based access (RBAC) categories for each system and data store, and a workforce member receives the minimum access necessary for their role. Administrative privilege is limited to users with a documented business need and must not include the ability to alter or delete audit/log data.

2. Unique identification and authentication (164.312(a)(2)(i), 164.312(d))

Every user is assigned a unique identifier so that all activity is traceable to an individual. Shared, group, or generic accounts are prohibited, and default vendor accounts are disabled or renamed before a system is placed in service. Identity is verified before access is granted and before any security-sensitive support request (e.g., password reset) is honored.

3. Multi-factor authentication (MFA)

MFA is required wherever it is supported, and always for: remote access, the [cloud productivity & storage suite], the [identity provider / single sign-on], source-control and production systems, and any system holding ePHI. Authentication combines at least two factors: something you know (password/PIN), something you have (device, token), or something you are (biometric).

4. Passwords and authenticators (164.308(a)(5)(ii)(D))

Passwords protecting access to ePHI must meet, at minimum:

• a length-first standard: at least 12 characters (passphrases encouraged), or 8+ characters with a mix of upper/lower case, a number, and a special character;
• screening against commonly used or known-breached passwords;
• a unique password per system; reuse of the last several passwords is prevented;
• secure storage and transmission only (hashed at rest, encrypted in transit, never plaintext);
• immediate reset on suspected compromise.

Use of a [password manager] is encouraged. Routine forced expiration is not required for MFA-protected user accounts (consistent with current NIST guidance); credentials are rotated on compromise, on offboarding of anyone who knew a shared secret, and per a defined interval for privileged or shared accounts. [Organization] may strengthen any item above.

5. Access authorization, establishment, and modification (164.308(a)(4)(ii)(B), 164.308(a)(4)(ii)(C), 164.308(a)(3)(ii)(A))

Access is granted only after documented authorization by the [Security Official] (or a designated approver) based on role. Requests for access beyond a role's standard set must include a business justification. Account creation, enablement, modification, disablement, and removal follow the documented process in the companion Access Control Procedures, are aligned with HR joiner/mover/leaver events, and are tracked in a [ticketing system]. Supervision is applied to workforce members whose roles involve access to ePHI.

6. Workforce access and termination (164.308(a)(3)(i), 164.308(a)(3)(ii)(C))

[Organization] ensures that workforce members have appropriate access and that those who should not have access to ePHI are prevented from obtaining it. Access is revoked promptly upon termination or role change: targeted at the time of separation and no later than [24 hours] after notification. (Pre-hire screening and sanctions are governed by the Workforce Security, Training & Sanctions Policy.)

7. Access reviews

The [Security Official] reviews access rights against role and least-privilege at least annually, and [quarterly] for systems containing ePHI, and on any role change. Findings and any resulting changes are documented. Accounts inactive beyond [90 days] are disabled.

8. Automatic logoff and device lock (164.312(a)(2)(iii))

Systems and devices that access ePHI lock or terminate the session after a defined period of inactivity ([15 minutes] for endpoints). Users must lock or log off unattended devices; a password/credential is required to re-establish access.

9. Emergency access (164.312(a)(2)(ii))

A documented emergency ("break-glass") procedure allows designated personnel to obtain necessary ePHI during an emergency (e.g., outage of the normal access path or staff unavailability). Break-glass use is pre-authorized to named roles, logged, and reviewed after the fact by the [Security Official].

10. Unsuccessful logon attempts

Where supported, systems lock an account after [5] consecutive failed attempts within [30 minutes] for at least [30 minutes]; privileged accounts require administrator unlock, and the administrator is notified.

11. Separation of duties (164.312(a)(1))

High-risk processes identified by the risk-management process (e.g., production deployments, financial transactions, major infrastructure changes) require separation of duties so that no single individual controls the entire process.

12. Isolation of clearinghouse functions (164.308(a)(4)(ii)(A))

If [Organization] performs health-care clearinghouse functions as part of a larger organization, it implements policies and procedures that protect that ePHI from unauthorized access by the larger organization. (If not applicable, mark N/A and document why.)

Roles & Responsibilities

• [Security Official]: owns this Policy; approves access standards, authorizations, and exceptions; conducts access reviews.
• System / data owners: define role-based access for their systems and support reviews.
• Human Resources / managers: initiate joiner/mover/leaver notifications.
• Workforce members: use only their own credentials, protect authenticators, and report suspected compromise immediately.

Related documents

Access Control Procedures · Workforce Security, Training & Sanctions Policy · Audit Controls & Activity Review Policy · Security Incident Response Policy.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official] and after any significant change to the ePHI environment. v1.0.