Domain C: Information Access Management
Role-based access, unique user IDs, and the access-authorization paper trail.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Unique user ID assigned to every person accessing ePHI systems
45 C.F.R. §164.312(a)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
Emergency access procedure documented and tested
45 C.F.R. §164.312(a)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.312
Health care clearinghouse functions isolated from larger organization systems (if applicable)
45 C.F.R. §164.308(a)(4)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Access authorization decisions documented per role, tied to job function
45 C.F.R. §164.308(a)(4)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Access establishment and modification procedure
45 C.F.R. §164.308(a)(4)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Periodic access review performed on active accounts, not only at onboarding
45 C.F.R. §164.308(a)(4) · Source: www.ecfr.gov/current/title-45/section-164.308
Automatic session logoff configured on workstations and applications
45 C.F.R. §164.312(a)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.312