Access Control Procedures

Free HIPAA procedures template · v1.0 · Applies to covered entities & business associates · Companion: Policy →

Free, no signup needed. Also as PDF · Markdown.

What these procedures commit you to

Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:

Access Management: 164.308(a)(3)(ii)(C) · 164.308(a)(4)(ii)(B) · 164.308(a)(4)(ii)(C) · 164.308(a)(5)(ii)(D) · 164.312(a)(2)(i) · 164.312(a)(2)(ii) · 164.312(d)

Related threat scenarios

Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:

AdversarialMalicious insider / excess access
Exploits: No least-privilege; no access reviews · 164.308(a)(4) Access Mgmt; 164.312(a) Access Control
AdversarialPhishing / credential theft
Exploits: No or weak MFA; reused passwords · 164.312(d) Authentication; 164.308(a)(5) Training
AccidentalAccidental disclosure / over-share
Exploits: No access controls on shares · 164.312(a) Access Control; 164.514(d)

HowToHIPAAhowtohipaa.com

Access Control Procedures

Template. These procedures operationalize the Access Control Policy. Replace [bracketed] items with your specifics and adjust steps to match your tools and team size.

Purpose

To provide repeatable, auditable steps for provisioning, modifying, reviewing, and revoking access to [Organization] systems and ePHI, and for password resets and emergency access, implementing the Access Control Policy.

1. New account provisioning (164.308(a)(4)(ii)(B), 164.312(d))

HR or the hiring manager records the new workforce member in the [HR onboarding system] (name, start date, title/department, employment type) once all employment prerequisites (offer, NDA, background check, required training) are complete.
The [Security Official] provisions the core accounts required for all workforce members; the manager requests any role-specific systems from the [approved-software list], each requiring approval per §5 of the Policy.
Identity is verified before accounts are issued, in person where possible, otherwise over a pre-registered channel (e.g., phone), and the verification method is recorded in the .

See where your organization stands on the controls this template cites.

Join Us

Related Access Management templates

Access Control Policypolicy
Access Request & Review Logreference
Onboarding / Offboarding Trackerreference
Role / Permission (Access) Matrixreference

More Access Management templates →Read the Access Management guide →

[access request log]

Accounts are created with a unique ID and a single-use temporary credential that must be changed at first login; MFA is enrolled at first login wherever supported.

Access information is delivered to the new member over an authenticated channel on/after the start date, and the request is stored in the [ticketing system].

2. Access modification (role change or elevated access) (164.308(a)(4)(ii)(C))

The workforce member or an authorized requester opens a request in the [ticketing system]: action (add/remove), system(s), level of access, and justification.
The [Security Official] or system owner reviews and approves or rejects (rejections return for more detail).
On approval, the change is executed and the ticket retained as the record. Role transfers trigger removal of access no longer needed.

3. Access termination / offboarding (164.308(a)(3)(ii)(C))

HR or a leadership member notifies the [Security Official] of the separation, ideally before it occurs, with name, effective date/time, and any details needed to close access securely.
At the time of separation, access is disabled across all systems (directory/SSO, email, applications, remote access, physical credentials), and shared secrets the person knew are rotated.
The [Security Official] confirms closure and records it in the [ticketing system].
If the departing person is the [Security Official] or sole administrator, leadership designates an alternate (or a vetted third party) to perform closure, documented in the [ticketing system].

Offboarding checklist (representative): disable email & accounts · revoke SSO/MFA · remove from distribution lists & directories · recover/wipe devices · transfer data ownership · confirm & sign.

4. Periodic access review (164.308(a)(4)(ii)(C))

The [Security Official] opens a review record at the defined cadence (at least annually; [quarterly] for ePHI systems).
Access for each workforce member is compared to role and least-privilege; deviations are corrected via §2 and the user is notified.
Inactive accounts (beyond [90 days]) and unneeded temporary accounts are disabled/removed.
The completed review is documented and signed off.

5. Password reset (164.308(a)(5)(ii)(D), 164.312(d))

The user submits a reset request identifying the affected system.
An administrator with reset rights verifies identity in person or over a separate pre-registered channel before acting.
The administrator issues a single-use credential; the user sets a new password meeting Policy §4 at next login.

6. Emergency ("break-glass") access (164.312(a)(2)(ii))

Break-glass access is pre-authorized to named roles for defined emergency scenarios (normal access path unavailable, key personnel unreachable during an ePHI-affecting event).
The user invokes the documented break-glass method (e.g., a sealed/escrowed credential or a secondary admin path) and the action is logged.
Within [24 hours], the [Security Official] reviews the access, confirms it was warranted, and rotates any credential used.

Records produced (evidence)

Access request & authorization records · identity-verification notes · provisioning/termination tickets · periodic access-review sign-offs · break-glass invocation logs. These are the artifacts an auditor will request to confirm the controls operate.

HIPAA controls addressed

Citation	Requirement	Addressed in
164.308(a)(4)(ii)(B)	Access Authorization	§1
164.312(d)	Person or Entity Authentication	§1, §5
164.308(a)(4)(ii)(C)	Access Establishment & Modification	§2, §4
164.308(a)(3)(ii)(C)	Termination Procedures	§3
164.308(a)(5)(ii)(D)	Password Management	§5
164.312(a)(2)(ii)	Emergency Access Procedure	§6
164.312(a)(2)(i)	Unique User Identification	§1

Reviewed at least annually by the [Security Official]. v1.0.

Access Control Procedures

What these procedures commit you to

Related threat scenarios

Access Control Procedures

Purpose

1. New account provisioning (164.308(a)(4)(ii)(B), 164.312(d))

Related Access Management templates

2. Access modification (role change or elevated access) (164.308(a)(4)(ii)(C))

3. Access termination / offboarding (164.308(a)(3)(ii)(C))

4. Periodic access review (164.308(a)(4)(ii)(C))

5. Password reset (164.308(a)(5)(ii)(D), 164.312(d))

6. Emergency ("break-glass") access (164.312(a)(2)(ii))

Records produced (evidence)

HIPAA controls addressed

Review & version